Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 sysopsandClaude Sonnet 5
|
2026514404 |
+1
-10
@@ -8,7 +8,6 @@ import (
|
||||
"gitea.perlbach24.de/scripte/nexarch/internal/config"
|
||||
"gitea.perlbach24.de/scripte/nexarch/internal/db"
|
||||
"gitea.perlbach24.de/scripte/nexarch/internal/tenant"
|
||||
"gitea.perlbach24.de/scripte/nexarch/internal/user"
|
||||
)
|
||||
|
||||
func main() {
|
||||
@@ -35,20 +34,12 @@ func main() {
|
||||
provisioner := tenant.NewProvisioner(adminPool, registry, cfg.TenantDSNTemplate)
|
||||
tenantHandler := tenant.NewHandler(provisioner)
|
||||
|
||||
// Superadmin-Konten leben mandantenuebergreifend in der Registry-DB.
|
||||
// Tenant-User-CRUD (user.TenantUserStore) braucht Connection-Routing pro
|
||||
// Mandant (TEN-06, noch nicht gebaut) und wird hier bewusst noch nicht
|
||||
// verdrahtet — Package ist bereits eigenstaendig nutzbar/testbar.
|
||||
superadmins := user.NewSuperadminStore(registryPool)
|
||||
userHandler := user.NewHandler(nil, superadmins)
|
||||
|
||||
mux := http.NewServeMux()
|
||||
mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
|
||||
w.WriteHeader(http.StatusOK)
|
||||
})
|
||||
// Vorlaeufige Pfade ohne Versionierung/Auth — werden mit API-01/IAM-02 abgeloest.
|
||||
// Vorlaeufiger Pfad ohne Versionierung/Auth — wird mit API-01/IAM-01 abgeloest.
|
||||
mux.HandleFunc("/internal/tenants", tenantHandler.CreateTenant)
|
||||
mux.HandleFunc("/internal/superadmins", userHandler.CreateSuperadmin)
|
||||
|
||||
log.Printf("nexarch-core listening on %s", cfg.ListenAddr)
|
||||
if err := http.ListenAndServe(cfg.ListenAddr, mux); err != nil {
|
||||
|
||||
@@ -1,71 +0,0 @@
|
||||
// Package rbac implementiert Core RBAC-01: das Rollenmodell mit
|
||||
// Grundrollen/-rechten, Hierarchie und Zuweisung. Die eigentliche
|
||||
// Durchsetzung (erlaubt/verboten je Request) ist RBAC-02, dieses Paket
|
||||
// liefert nur Modell + Zuweisung (Casbin-Prinzip: Policy-Modell getrennt
|
||||
// von der Entscheidungsfunktion).
|
||||
package rbac
|
||||
|
||||
// Role ist eine der drei Grundrollen. Superadmin lebt mandantenuebergreifend
|
||||
// (siehe internal/user.SuperadminStore aus IAM-01) und wird deshalb NICHT
|
||||
// ueber Store (tenant-gescoped) zugewiesen — die Existenz eines Superadmin-
|
||||
// Kontos IST die Rollenzuweisung.
|
||||
type Role string
|
||||
|
||||
const (
|
||||
RoleSuperadmin Role = "superadmin"
|
||||
RoleTenantAdmin Role = "tenant_admin"
|
||||
RoleUser Role = "user"
|
||||
)
|
||||
|
||||
type Permission string
|
||||
|
||||
const (
|
||||
PermSelfRead Permission = "self.read"
|
||||
PermSelfUpdate Permission = "self.update"
|
||||
PermManageUsers Permission = "tenant.manage_users"
|
||||
PermManageSettings Permission = "tenant.manage_settings"
|
||||
PermManageTenants Permission = "platform.manage_tenants"
|
||||
)
|
||||
|
||||
// parent bildet die Rollenhierarchie ab (Akzeptanzkriterium 2): eine Rolle
|
||||
// erbt alle Rechte ihrer Elternrolle. tenant_admin erbt von user,
|
||||
// superadmin erbt von tenant_admin.
|
||||
var parent = map[Role]Role{
|
||||
RoleTenantAdmin: RoleUser,
|
||||
RoleSuperadmin: RoleTenantAdmin,
|
||||
}
|
||||
|
||||
// direct sind die einer Rolle direkt (ohne Vererbung) zugeordneten Rechte.
|
||||
var direct = map[Role][]Permission{
|
||||
RoleUser: {PermSelfRead, PermSelfUpdate},
|
||||
RoleTenantAdmin: {PermManageUsers, PermManageSettings},
|
||||
RoleSuperadmin: {PermManageTenants},
|
||||
}
|
||||
|
||||
// EffectivePermissions liefert die vollstaendige, ueber die Hierarchie
|
||||
// aufgeloeste Rechtemenge einer Rolle (Akzeptanzkriterium 2 / Pruefung 2).
|
||||
func EffectivePermissions(role Role) []Permission {
|
||||
seen := make(map[Permission]bool)
|
||||
var out []Permission
|
||||
|
||||
for r, ok := role, true; ok; r, ok = parent[r] {
|
||||
for _, p := range direct[r] {
|
||||
if !seen[p] {
|
||||
seen[p] = true
|
||||
out = append(out, p)
|
||||
}
|
||||
}
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
// HasPermission prueft, ob eine Rolle (inklusive geerbter Rechte) ein
|
||||
// bestimmtes Recht besitzt.
|
||||
func HasPermission(role Role, perm Permission) bool {
|
||||
for _, p := range EffectivePermissions(role) {
|
||||
if p == perm {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
@@ -1,48 +0,0 @@
|
||||
package rbac
|
||||
|
||||
import "testing"
|
||||
|
||||
func contains(perms []Permission, p Permission) bool {
|
||||
for _, x := range perms {
|
||||
if x == p {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 2 + Pruefung 2: Rollenhierarchie liefert die erwartete
|
||||
// effektive Rechtemenge.
|
||||
func TestEffectivePermissions_Inheritance(t *testing.T) {
|
||||
userPerms := EffectivePermissions(RoleUser)
|
||||
if !contains(userPerms, PermSelfRead) || !contains(userPerms, PermSelfUpdate) {
|
||||
t.Fatalf("user sollte self.read/self.update haben, habe %v", userPerms)
|
||||
}
|
||||
if contains(userPerms, PermManageUsers) {
|
||||
t.Fatal("user sollte KEIN tenant.manage_users haben")
|
||||
}
|
||||
|
||||
adminPerms := EffectivePermissions(RoleTenantAdmin)
|
||||
if !contains(adminPerms, PermSelfRead) || !contains(adminPerms, PermManageUsers) || !contains(adminPerms, PermManageSettings) {
|
||||
t.Fatalf("tenant_admin sollte geerbte user-rechte + eigene rechte haben, habe %v", adminPerms)
|
||||
}
|
||||
if contains(adminPerms, PermManageTenants) {
|
||||
t.Fatal("tenant_admin sollte KEIN platform.manage_tenants haben")
|
||||
}
|
||||
|
||||
superPerms := EffectivePermissions(RoleSuperadmin)
|
||||
for _, want := range []Permission{PermSelfRead, PermSelfUpdate, PermManageUsers, PermManageSettings, PermManageTenants} {
|
||||
if !contains(superPerms, want) {
|
||||
t.Fatalf("superadmin sollte %q haben (volle vererbte kette), habe %v", want, superPerms)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestHasPermission(t *testing.T) {
|
||||
if !HasPermission(RoleTenantAdmin, PermSelfRead) {
|
||||
t.Fatal("tenant_admin sollte geerbtes self.read haben")
|
||||
}
|
||||
if HasPermission(RoleUser, PermManageTenants) {
|
||||
t.Fatal("user sollte platform.manage_tenants nicht haben")
|
||||
}
|
||||
}
|
||||
@@ -1,124 +0,0 @@
|
||||
package rbac
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
|
||||
"github.com/jackc/pgx/v5"
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
)
|
||||
|
||||
var (
|
||||
// ErrRoleNotAssignableInTenantScope wird geliefert, wenn versucht wird,
|
||||
// eine mandantenuebergreifende Rolle (superadmin) ueber den tenant-
|
||||
// gescopten Store zu vergeben — die erlaubte Matrix laesst hier nur
|
||||
// user/tenant_admin zu (Akzeptanzkriterium 1 / Pruefung 1).
|
||||
ErrRoleNotAssignableInTenantScope = errors.New("rbac: rolle ist in diesem geltungsbereich nicht zuweisbar")
|
||||
ErrNotFound = errors.New("rbac: keine rollenzuweisung gefunden")
|
||||
)
|
||||
|
||||
// assignableRoles ist die erlaubte Matrix fuer Store (tenant-gescoped).
|
||||
var assignableRoles = map[Role]bool{
|
||||
RoleUser: true,
|
||||
RoleTenantAdmin: true,
|
||||
}
|
||||
|
||||
type Assignment struct {
|
||||
UserID string
|
||||
Role Role
|
||||
GrantedBy string
|
||||
}
|
||||
|
||||
// Store verwaltet Rollenzuweisungen innerhalb GENAU EINER Tenant-Datenbank —
|
||||
// analog zu internal/user.TenantUserStore (Modell C: der Pool bestimmt den
|
||||
// Tenant, keine tenant_id-Spalte noetig).
|
||||
type Store struct {
|
||||
pool *pgxpool.Pool
|
||||
}
|
||||
|
||||
func NewStore(pool *pgxpool.Pool) *Store {
|
||||
return &Store{pool: pool}
|
||||
}
|
||||
|
||||
// Assign vergibt eine Rolle an einen Benutzer. grantedBy identifiziert den
|
||||
// Akteur, der die Zuweisung vorgenommen hat (Akzeptanzkriterium 3). Jede
|
||||
// Zuweisung wird zusaetzlich in role_assignment_history festgehalten, auch
|
||||
// wenn sie eine vorherige Rolle ersetzt.
|
||||
func (s *Store) Assign(ctx context.Context, userID string, role Role, grantedBy string) (Assignment, error) {
|
||||
if !assignableRoles[role] {
|
||||
return Assignment{}, ErrRoleNotAssignableInTenantScope
|
||||
}
|
||||
if grantedBy == "" {
|
||||
return Assignment{}, errors.New("rbac: grantedBy darf nicht leer sein")
|
||||
}
|
||||
|
||||
tx, err := s.pool.Begin(ctx)
|
||||
if err != nil {
|
||||
return Assignment{}, fmt.Errorf("transaktion starten: %w", err)
|
||||
}
|
||||
defer func() { _ = tx.Rollback(ctx) }()
|
||||
|
||||
if _, err := tx.Exec(ctx, `
|
||||
INSERT INTO role_assignments (user_id, role, granted_by, granted_at)
|
||||
VALUES ($1, $2, $3, now())
|
||||
ON CONFLICT (user_id) DO UPDATE SET role = $2, granted_by = $3, granted_at = now()
|
||||
`, userID, string(role), grantedBy); err != nil {
|
||||
return Assignment{}, fmt.Errorf("rolle zuweisen: %w", err)
|
||||
}
|
||||
|
||||
if _, err := tx.Exec(ctx, `
|
||||
INSERT INTO role_assignment_history (user_id, role, granted_by, granted_at)
|
||||
VALUES ($1, $2, $3, now())
|
||||
`, userID, string(role), grantedBy); err != nil {
|
||||
return Assignment{}, fmt.Errorf("historie schreiben: %w", err)
|
||||
}
|
||||
|
||||
if err := tx.Commit(ctx); err != nil {
|
||||
return Assignment{}, fmt.Errorf("transaktion committen: %w", err)
|
||||
}
|
||||
|
||||
return Assignment{UserID: userID, Role: role, GrantedBy: grantedBy}, nil
|
||||
}
|
||||
|
||||
func (s *Store) Get(ctx context.Context, userID string) (Assignment, error) {
|
||||
var a Assignment
|
||||
var role string
|
||||
a.UserID = userID
|
||||
if err := s.pool.QueryRow(ctx, `
|
||||
SELECT role, granted_by FROM role_assignments WHERE user_id = $1
|
||||
`, userID).Scan(&role, &a.GrantedBy); err != nil {
|
||||
if errors.Is(err, pgx.ErrNoRows) {
|
||||
return Assignment{}, ErrNotFound
|
||||
}
|
||||
return Assignment{}, fmt.Errorf("rollenzuweisung lesen: %w", err)
|
||||
}
|
||||
a.Role = Role(role)
|
||||
return a, nil
|
||||
}
|
||||
|
||||
// History liefert jede Rollenzuweisung eines Benutzers in chronologischer
|
||||
// Reihenfolge — die Grundlage fuer "wer hat wann welche Rolle vergeben"
|
||||
// (Akzeptanzkriterium 3).
|
||||
func (s *Store) History(ctx context.Context, userID string) ([]Assignment, error) {
|
||||
rows, err := s.pool.Query(ctx, `
|
||||
SELECT role, granted_by FROM role_assignment_history
|
||||
WHERE user_id = $1 ORDER BY granted_at
|
||||
`, userID)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("historie abfragen: %w", err)
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
var out []Assignment
|
||||
for rows.Next() {
|
||||
var role string
|
||||
a := Assignment{UserID: userID}
|
||||
if err := rows.Scan(&role, &a.GrantedBy); err != nil {
|
||||
return nil, fmt.Errorf("historieneintrag lesen: %w", err)
|
||||
}
|
||||
a.Role = Role(role)
|
||||
out = append(out, a)
|
||||
}
|
||||
return out, rows.Err()
|
||||
}
|
||||
@@ -1,144 +0,0 @@
|
||||
package rbac
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"os"
|
||||
"testing"
|
||||
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
|
||||
"gitea.perlbach24.de/scripte/nexarch/internal/user"
|
||||
)
|
||||
|
||||
func setupStoreTest(t *testing.T) (*Store, string, func()) {
|
||||
t.Helper()
|
||||
adminDSN := os.Getenv("TEST_ADMIN_DSN")
|
||||
if adminDSN == "" {
|
||||
t.Skip("TEST_ADMIN_DSN nicht gesetzt, Integrationstest uebersprungen")
|
||||
}
|
||||
ctx := context.Background()
|
||||
|
||||
pool, err := pgxpool.New(ctx, adminDSN)
|
||||
if err != nil {
|
||||
t.Fatalf("pool: %v", err)
|
||||
}
|
||||
if _, err := pool.Exec(ctx, `
|
||||
CREATE TABLE IF NOT EXISTS users (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
email TEXT NOT NULL UNIQUE,
|
||||
name TEXT NOT NULL,
|
||||
status TEXT NOT NULL DEFAULT 'active',
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||||
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS role_assignments (
|
||||
user_id UUID PRIMARY KEY REFERENCES users(id),
|
||||
role TEXT NOT NULL CHECK (role IN ('user', 'tenant_admin')),
|
||||
granted_by TEXT NOT NULL,
|
||||
granted_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
CREATE TABLE IF NOT EXISTS role_assignment_history (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
user_id UUID NOT NULL,
|
||||
role TEXT NOT NULL,
|
||||
granted_by TEXT NOT NULL,
|
||||
granted_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
`); err != nil {
|
||||
t.Fatalf("schema: %v", err)
|
||||
}
|
||||
|
||||
userStore := user.NewTenantUserStore(pool)
|
||||
u, err := userStore.Create(ctx, "rbac_test@example.com", "RBAC Test")
|
||||
if err != nil {
|
||||
t.Fatalf("testuser anlegen: %v", err)
|
||||
}
|
||||
|
||||
cleanup := func() {
|
||||
_, _ = pool.Exec(ctx, `DELETE FROM role_assignment_history WHERE user_id = $1`, u.ID)
|
||||
_, _ = pool.Exec(ctx, `DELETE FROM role_assignments WHERE user_id = $1`, u.ID)
|
||||
_, _ = pool.Exec(ctx, `DELETE FROM users WHERE id = $1`, u.ID)
|
||||
pool.Close()
|
||||
}
|
||||
return NewStore(pool), u.ID, cleanup
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 1: Grundrollen sind einem Benutzer je Tenant zuweisbar.
|
||||
func TestStore_AssignAndGet(t *testing.T) {
|
||||
store, userID, cleanup := setupStoreTest(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
assigned, err := store.Assign(ctx, userID, RoleTenantAdmin, "admin@acme.example")
|
||||
if err != nil {
|
||||
t.Fatalf("assign: %v", err)
|
||||
}
|
||||
if assigned.Role != RoleTenantAdmin {
|
||||
t.Fatalf("erwartet tenant_admin, habe %q", assigned.Role)
|
||||
}
|
||||
|
||||
got, err := store.Get(ctx, userID)
|
||||
if err != nil {
|
||||
t.Fatalf("get: %v", err)
|
||||
}
|
||||
if got.Role != RoleTenantAdmin || got.GrantedBy != "admin@acme.example" {
|
||||
t.Fatalf("zuweisung unerwartet: %+v", got)
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 1 + Pruefung 1: Zuweisung ausserhalb der erlaubten
|
||||
// Matrix (superadmin im tenant-gescopten Store) wird abgewiesen.
|
||||
func TestStore_RejectsSuperadminOutsideAllowedMatrix(t *testing.T) {
|
||||
store, userID, cleanup := setupStoreTest(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
_, err := store.Assign(ctx, userID, RoleSuperadmin, "admin@acme.example")
|
||||
if !errors.Is(err, ErrRoleNotAssignableInTenantScope) {
|
||||
t.Fatalf("erwartet ErrRoleNotAssignableInTenantScope, habe %v", err)
|
||||
}
|
||||
|
||||
// Sicherstellen, dass der abgewiesene Versuch keine Zeile hinterlassen hat.
|
||||
if _, err := store.Get(ctx, userID); !errors.Is(err, ErrNotFound) {
|
||||
t.Fatalf("erwartet ErrNotFound nach abgewiesener zuweisung, habe %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestStore_RejectsUnknownRole(t *testing.T) {
|
||||
store, userID, cleanup := setupStoreTest(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
if _, err := store.Assign(ctx, userID, Role("erfunden"), "admin@acme.example"); !errors.Is(err, ErrRoleNotAssignableInTenantScope) {
|
||||
t.Fatalf("erwartet ErrRoleNotAssignableInTenantScope fuer unbekannte rolle, habe %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 3: Rollenzuweisung vollstaendig auditierbar.
|
||||
func TestStore_HistoryTracksWhoAndWhen(t *testing.T) {
|
||||
store, userID, cleanup := setupStoreTest(t)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
if _, err := store.Assign(ctx, userID, RoleUser, "system"); err != nil {
|
||||
t.Fatalf("assign 1: %v", err)
|
||||
}
|
||||
if _, err := store.Assign(ctx, userID, RoleTenantAdmin, "admin@acme.example"); err != nil {
|
||||
t.Fatalf("assign 2: %v", err)
|
||||
}
|
||||
|
||||
history, err := store.History(ctx, userID)
|
||||
if err != nil {
|
||||
t.Fatalf("history: %v", err)
|
||||
}
|
||||
if len(history) != 2 {
|
||||
t.Fatalf("erwartet 2 historieneintraege, habe %d", len(history))
|
||||
}
|
||||
if history[0].Role != RoleUser || history[0].GrantedBy != "system" {
|
||||
t.Fatalf("history[0] unerwartet: %+v", history[0])
|
||||
}
|
||||
if history[1].Role != RoleTenantAdmin || history[1].GrantedBy != "admin@acme.example" {
|
||||
t.Fatalf("history[1] unerwartet: %+v", history[1])
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,136 @@
|
||||
package tenant
|
||||
|
||||
import (
|
||||
"container/list"
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"sync"
|
||||
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
)
|
||||
|
||||
// ErrMissingTenantContext wird geliefert, wenn keine Tenant-Kennung
|
||||
// uebergeben wurde — es gibt bewusst keinen impliziten Default-Tenant
|
||||
// (TEN-06 Akzeptanzkriterium 3).
|
||||
var ErrMissingTenantContext = errors.New("tenant: kein tenant-kontext angegeben")
|
||||
|
||||
// ErrUnknownTenant wird geliefert, wenn die Tenant-Kennung in der Registry
|
||||
// nicht existiert.
|
||||
var ErrUnknownTenant = errors.New("tenant: unbekannter tenant")
|
||||
|
||||
// Router loest den Tenant-Kontext (Slug, aus dem JWT-Claim von API-05) in
|
||||
// eine wiederverwendbare Verbindung zur richtigen Tenant-Datenbank auf.
|
||||
// Ein LRU-verwalteter Cache begrenzt die Zahl gleichzeitig offener
|
||||
// pgxpool.Pool-Instanzen, damit die Zahl offener Postgres-Verbindungen NICHT
|
||||
// linear mit der Mandantenzahl waechst (Akzeptanzkriterium 2).
|
||||
type Router struct {
|
||||
registry *Registry
|
||||
maxOpen int
|
||||
|
||||
mu sync.Mutex
|
||||
order *list.List // vorne = zuletzt benutzt
|
||||
items map[string]*list.Element // slug -> element mit *routerEntry
|
||||
}
|
||||
|
||||
type routerEntry struct {
|
||||
slug string
|
||||
pool *pgxpool.Pool
|
||||
}
|
||||
|
||||
func NewRouter(registry *Registry, maxOpen int) *Router {
|
||||
if maxOpen < 1 {
|
||||
maxOpen = 1
|
||||
}
|
||||
return &Router{
|
||||
registry: registry,
|
||||
maxOpen: maxOpen,
|
||||
order: list.New(),
|
||||
items: make(map[string]*list.Element),
|
||||
}
|
||||
}
|
||||
|
||||
// Resolve liefert einen wiederverwendeten Pool fuer den angegebenen Tenant.
|
||||
// Ist der Tenant bereits im Cache, wird KEINE neue Verbindung aufgebaut
|
||||
// (Akzeptanzkriterium 2 / Pruefung 3).
|
||||
func (r *Router) Resolve(ctx context.Context, tenantSlug string) (*pgxpool.Pool, error) {
|
||||
if tenantSlug == "" {
|
||||
return nil, ErrMissingTenantContext
|
||||
}
|
||||
|
||||
r.mu.Lock()
|
||||
if el, ok := r.items[tenantSlug]; ok {
|
||||
r.order.MoveToFront(el)
|
||||
pool := el.Value.(*routerEntry).pool
|
||||
r.mu.Unlock()
|
||||
return pool, nil
|
||||
}
|
||||
r.mu.Unlock()
|
||||
|
||||
// Registry-Lookup und Verbindungsaufbau bewusst ausserhalb des Locks,
|
||||
// damit ein langsamer Verbindungsaufbau nicht alle anderen Tenants blockiert.
|
||||
t, err := r.registry.GetBySlug(ctx, tenantSlug)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("%w: %s", ErrUnknownTenant, tenantSlug)
|
||||
}
|
||||
|
||||
pool, err := pgxpool.New(ctx, t.DBDSN)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("verbindung zu tenant %q aufbauen: %w", tenantSlug, err)
|
||||
}
|
||||
|
||||
r.mu.Lock()
|
||||
defer r.mu.Unlock()
|
||||
|
||||
// Zwischen Unlock oben und hier koennte ein paralleler Aufruf denselben
|
||||
// Tenant bereits eingefuegt haben — dann die eigene, ueberzaehlige
|
||||
// Verbindung wieder schliessen und die vorhandene verwenden.
|
||||
if el, ok := r.items[tenantSlug]; ok {
|
||||
r.order.MoveToFront(el)
|
||||
existing := el.Value.(*routerEntry).pool
|
||||
pool.Close()
|
||||
return existing, nil
|
||||
}
|
||||
|
||||
el := r.order.PushFront(&routerEntry{slug: tenantSlug, pool: pool})
|
||||
r.items[tenantSlug] = el
|
||||
|
||||
if r.order.Len() > r.maxOpen {
|
||||
r.evictOldest()
|
||||
}
|
||||
|
||||
return pool, nil
|
||||
}
|
||||
|
||||
// evictOldest schliesst den am laengsten nicht genutzten Pool. Muss mit
|
||||
// gehaltenem r.mu aufgerufen werden.
|
||||
func (r *Router) evictOldest() {
|
||||
oldest := r.order.Back()
|
||||
if oldest == nil {
|
||||
return
|
||||
}
|
||||
entry := oldest.Value.(*routerEntry)
|
||||
r.order.Remove(oldest)
|
||||
delete(r.items, entry.slug)
|
||||
entry.pool.Close()
|
||||
}
|
||||
|
||||
// OpenCount liefert die aktuelle Zahl offen gehaltener Tenant-Pools —
|
||||
// dient Tests/Monitoring, um AC2 nachzuweisen.
|
||||
func (r *Router) OpenCount() int {
|
||||
r.mu.Lock()
|
||||
defer r.mu.Unlock()
|
||||
return r.order.Len()
|
||||
}
|
||||
|
||||
// Close schliesst alle offen gehaltenen Tenant-Pools, z.B. beim
|
||||
// Herunterfahren des Core-Prozesses.
|
||||
func (r *Router) Close() {
|
||||
r.mu.Lock()
|
||||
defer r.mu.Unlock()
|
||||
for el := r.order.Front(); el != nil; el = el.Next() {
|
||||
el.Value.(*routerEntry).pool.Close()
|
||||
}
|
||||
r.order.Init()
|
||||
r.items = make(map[string]*list.Element)
|
||||
}
|
||||
@@ -0,0 +1,160 @@
|
||||
package tenant
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"os"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
)
|
||||
|
||||
func newTestRouterSetup(t *testing.T, tenantCount int) (*Router, []Tenant, func()) {
|
||||
t.Helper()
|
||||
adminDSN := os.Getenv("TEST_ADMIN_DSN")
|
||||
if adminDSN == "" {
|
||||
t.Skip("TEST_ADMIN_DSN nicht gesetzt, Integrationstest uebersprungen")
|
||||
}
|
||||
ctx := context.Background()
|
||||
|
||||
adminPool, err := pgxpool.New(ctx, adminDSN)
|
||||
if err != nil {
|
||||
t.Fatalf("admin pool: %v", err)
|
||||
}
|
||||
registryPool, err := pgxpool.New(ctx, adminDSN)
|
||||
if err != nil {
|
||||
t.Fatalf("registry pool: %v", err)
|
||||
}
|
||||
if _, err := registryPool.Exec(ctx, `
|
||||
CREATE TABLE IF NOT EXISTS tenants (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
slug TEXT NOT NULL UNIQUE,
|
||||
name TEXT NOT NULL,
|
||||
db_name TEXT NOT NULL UNIQUE,
|
||||
db_dsn TEXT NOT NULL,
|
||||
status TEXT NOT NULL DEFAULT 'active',
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
)`); err != nil {
|
||||
t.Fatalf("registry-schema: %v", err)
|
||||
}
|
||||
|
||||
registry := NewRegistry(registryPool)
|
||||
dsnTemplate := strings.Replace(adminDSN, "/postgres?", "/%s?", 1)
|
||||
provisioner := NewProvisioner(adminPool, registry, dsnTemplate)
|
||||
|
||||
var tenants []Tenant
|
||||
var slugs []string
|
||||
for i := 0; i < tenantCount; i++ {
|
||||
slug := fmt.Sprintf("router_t%d", i)
|
||||
slugs = append(slugs, slug)
|
||||
tn, err := provisioner.Provision(ctx, slug, slug)
|
||||
if err != nil {
|
||||
t.Fatalf("provision %s: %v", slug, err)
|
||||
}
|
||||
tenants = append(tenants, tn)
|
||||
}
|
||||
|
||||
router := NewRouter(registry, 2) // klein gewaehlt, um Eviction im Test zu erzwingen
|
||||
|
||||
cleanup := func() {
|
||||
router.Close()
|
||||
for _, slug := range slugs {
|
||||
_, _ = adminPool.Exec(ctx, fmt.Sprintf(`DROP DATABASE IF EXISTS %q`, dbNameForSlug(slug)))
|
||||
}
|
||||
_, _ = registryPool.Exec(ctx, `DELETE FROM tenants WHERE slug = ANY($1)`, slugs)
|
||||
registryPool.Close()
|
||||
adminPool.Close()
|
||||
}
|
||||
return router, tenants, cleanup
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 1: Verbindung wird zuverlaessig anhand des Tenant-Kontexts aufgeloest.
|
||||
func TestRouter_ResolvesCorrectTenantDatabase(t *testing.T) {
|
||||
router, tenants, cleanup := newTestRouterSetup(t, 2)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
pool, err := router.Resolve(ctx, tenants[0].Slug)
|
||||
if err != nil {
|
||||
t.Fatalf("resolve: %v", err)
|
||||
}
|
||||
var dbName string
|
||||
if err := pool.QueryRow(ctx, `SELECT current_database()`).Scan(&dbName); err != nil {
|
||||
t.Fatalf("current_database: %v", err)
|
||||
}
|
||||
if dbName != tenants[0].DBName {
|
||||
t.Fatalf("current_database() = %q, want %q", dbName, tenants[0].DBName)
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 3 + Pruefung 2: fehlender/unbekannter Tenant-Kontext
|
||||
// wird explizit abgewiesen statt irgendeine Verbindung zu liefern.
|
||||
func TestRouter_RejectsMissingOrUnknownTenant(t *testing.T) {
|
||||
router, _, cleanup := newTestRouterSetup(t, 1)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
if _, err := router.Resolve(ctx, ""); !errors.Is(err, ErrMissingTenantContext) {
|
||||
t.Fatalf("erwartet ErrMissingTenantContext, habe %v", err)
|
||||
}
|
||||
if _, err := router.Resolve(ctx, "nie-registrierter-slug"); !errors.Is(err, ErrUnknownTenant) {
|
||||
t.Fatalf("erwartet ErrUnknownTenant, habe %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 2 + Pruefung 3: Verbindungswiederverwendung nachweislich
|
||||
// gemessen — zweiter Resolve-Aufruf liefert exakt denselben Pool, kein
|
||||
// erneuter Verbindungsaufbau.
|
||||
func TestRouter_ReusesConnectionForSameTenant(t *testing.T) {
|
||||
router, tenants, cleanup := newTestRouterSetup(t, 1)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
first, err := router.Resolve(ctx, tenants[0].Slug)
|
||||
if err != nil {
|
||||
t.Fatalf("resolve 1: %v", err)
|
||||
}
|
||||
second, err := router.Resolve(ctx, tenants[0].Slug)
|
||||
if err != nil {
|
||||
t.Fatalf("resolve 2: %v", err)
|
||||
}
|
||||
if first != second {
|
||||
t.Fatal("erwartet identische pool-instanz bei wiederholtem resolve, habe unterschiedliche")
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 2 + Pruefung 1: Lasttest mit mehr simulierten Mandanten
|
||||
// als maxOpen — die Zahl gleichzeitig offener Tenant-Pools bleibt begrenzt
|
||||
// (LRU-Eviction), waechst also NICHT linear mit der Mandantenzahl.
|
||||
func TestRouter_BoundsOpenConnectionsUnderLoad(t *testing.T) {
|
||||
const tenantCount = 6
|
||||
router, tenants, cleanup := newTestRouterSetup(t, tenantCount)
|
||||
defer cleanup()
|
||||
ctx := context.Background()
|
||||
|
||||
for _, tn := range tenants {
|
||||
if _, err := router.Resolve(ctx, tn.Slug); err != nil {
|
||||
t.Fatalf("resolve %s: %v", tn.Slug, err)
|
||||
}
|
||||
if router.OpenCount() > 2 {
|
||||
t.Fatalf("OpenCount() = %d, erwartet <= maxOpen (2) nach jedem Resolve", router.OpenCount())
|
||||
}
|
||||
}
|
||||
|
||||
if router.OpenCount() != 2 {
|
||||
t.Fatalf("erwartet genau maxOpen=2 offene pools nach %d tenants, habe %d", tenantCount, router.OpenCount())
|
||||
}
|
||||
|
||||
// Evictete Tenants sind wieder ganz normal ueber die Registry aufloesbar
|
||||
// (Cache-Miss fuehrt zu neuem, funktionierendem Pool, kein Fehlerzustand).
|
||||
pool, err := router.Resolve(ctx, tenants[0].Slug)
|
||||
if err != nil {
|
||||
t.Fatalf("resolve nach eviction: %v", err)
|
||||
}
|
||||
var one int
|
||||
if err := pool.QueryRow(ctx, `SELECT 1`).Scan(&one); err != nil {
|
||||
t.Fatalf("query nach re-resolve: %v", err)
|
||||
}
|
||||
}
|
||||
@@ -1,66 +0,0 @@
|
||||
package user
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"net/http"
|
||||
)
|
||||
|
||||
// Handler stellt die CRUD-API fuer Benutzerkonten bereit (IAM-01-Auftrag).
|
||||
// Auth/Sessions (IAM-02) und Rollen (RBAC-01) sind ausdruecklich nicht Teil
|
||||
// dieser Kachel und daher hier noch nicht angebunden.
|
||||
type Handler struct {
|
||||
users *TenantUserStore
|
||||
superadmins *SuperadminStore
|
||||
}
|
||||
|
||||
func NewHandler(users *TenantUserStore, superadmins *SuperadminStore) *Handler {
|
||||
return &Handler{users: users, superadmins: superadmins}
|
||||
}
|
||||
|
||||
type createUserRequest struct {
|
||||
Email string `json:"email"`
|
||||
Name string `json:"name"`
|
||||
}
|
||||
|
||||
func (h *Handler) CreateUser(w http.ResponseWriter, r *http.Request) {
|
||||
var req createUserRequest
|
||||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
||||
http.Error(w, "ungueltige Anfrage", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
|
||||
u, err := h.users.Create(r.Context(), req.Email, req.Name)
|
||||
writeUserResult(w, u, err)
|
||||
}
|
||||
|
||||
// CreateSuperadmin legt ein mandantenuebergreifendes Superadmin-Konto an —
|
||||
// bewusst ein eigener Endpunkt statt eines Tenant-Parameters mit Null-Wert.
|
||||
func (h *Handler) CreateSuperadmin(w http.ResponseWriter, r *http.Request) {
|
||||
var req createUserRequest
|
||||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
||||
http.Error(w, "ungueltige Anfrage", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
|
||||
u, err := h.superadmins.Create(r.Context(), req.Email, req.Name)
|
||||
writeUserResult(w, u, err)
|
||||
}
|
||||
|
||||
func writeUserResult(w http.ResponseWriter, u User, err error) {
|
||||
if err != nil {
|
||||
switch {
|
||||
case errors.Is(err, ErrInvalidEmail), errors.Is(err, ErrEmailTaken):
|
||||
http.Error(w, err.Error(), http.StatusBadRequest)
|
||||
case errors.Is(err, ErrNotFound):
|
||||
http.Error(w, err.Error(), http.StatusNotFound)
|
||||
default:
|
||||
http.Error(w, "benutzer konnte nicht verarbeitet werden", http.StatusInternalServerError)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
w.Header().Set("Content-Type", "application/json")
|
||||
w.WriteHeader(http.StatusCreated)
|
||||
_ = json.NewEncoder(w).Encode(u)
|
||||
}
|
||||
@@ -1,173 +0,0 @@
|
||||
package user
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"os"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
)
|
||||
|
||||
// setupTestDB legt eine frische, isolierte Testdatenbank an, wendet die
|
||||
// uebergebene Migration an und liefert einen verbundenen Pool. Wird ohne
|
||||
// TEST_ADMIN_DSN uebersprungen — siehe internal/tenant/provisioner_test.go
|
||||
// fuer dasselbe Muster.
|
||||
func setupTestDB(t *testing.T, dbName, schemaSQL string) *pgxpool.Pool {
|
||||
t.Helper()
|
||||
|
||||
adminDSN := os.Getenv("TEST_ADMIN_DSN")
|
||||
if adminDSN == "" {
|
||||
t.Skip("TEST_ADMIN_DSN nicht gesetzt, Integrationstest uebersprungen")
|
||||
}
|
||||
ctx := context.Background()
|
||||
|
||||
adminPool, err := pgxpool.New(ctx, adminDSN)
|
||||
if err != nil {
|
||||
t.Fatalf("admin pool: %v", err)
|
||||
}
|
||||
|
||||
_, _ = adminPool.Exec(ctx, fmt.Sprintf(`DROP DATABASE IF EXISTS %q`, dbName))
|
||||
if _, err := adminPool.Exec(ctx, fmt.Sprintf(`CREATE DATABASE %q`, dbName)); err != nil {
|
||||
t.Fatalf("testdatenbank anlegen: %v", err)
|
||||
}
|
||||
|
||||
dsn := strings.Replace(adminDSN, "/postgres?", "/"+dbName+"?", 1)
|
||||
pool, err := pgxpool.New(ctx, dsn)
|
||||
if err != nil {
|
||||
t.Fatalf("connect testdatenbank: %v", err)
|
||||
}
|
||||
|
||||
if _, err := pool.Exec(ctx, schemaSQL); err != nil {
|
||||
t.Fatalf("schema anwenden: %v", err)
|
||||
}
|
||||
|
||||
t.Cleanup(func() {
|
||||
pool.Close()
|
||||
_, _ = adminPool.Exec(ctx, fmt.Sprintf(`DROP DATABASE IF EXISTS %q`, dbName))
|
||||
adminPool.Close()
|
||||
})
|
||||
|
||||
return pool
|
||||
}
|
||||
|
||||
const usersSchema = `
|
||||
CREATE EXTENSION IF NOT EXISTS pgcrypto;
|
||||
CREATE TABLE users (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
email TEXT NOT NULL UNIQUE,
|
||||
name TEXT NOT NULL,
|
||||
status TEXT NOT NULL DEFAULT 'active',
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||||
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);`
|
||||
|
||||
const superadminsSchema = `
|
||||
CREATE EXTENSION IF NOT EXISTS pgcrypto;
|
||||
CREATE TABLE superadmins (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
email TEXT NOT NULL UNIQUE,
|
||||
name TEXT NOT NULL,
|
||||
status TEXT NOT NULL DEFAULT 'active',
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||||
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);`
|
||||
|
||||
// Akzeptanzkriterium 1 + 3, Pruefung 1 (inkl. Negativfall doppelte E-Mail).
|
||||
func TestTenantUserStore_CRUD(t *testing.T) {
|
||||
pool := setupTestDB(t, "test_iam01_users", usersSchema)
|
||||
store := NewTenantUserStore(pool)
|
||||
ctx := context.Background()
|
||||
|
||||
created, err := store.Create(ctx, "alice@example.com", "Alice")
|
||||
if err != nil {
|
||||
t.Fatalf("create: %v", err)
|
||||
}
|
||||
if created.Status != StatusActive {
|
||||
t.Fatalf("erwartet status active, hat %q", created.Status)
|
||||
}
|
||||
|
||||
got, err := store.Get(ctx, created.ID)
|
||||
if err != nil {
|
||||
t.Fatalf("get: %v", err)
|
||||
}
|
||||
if got.Email != "alice@example.com" {
|
||||
t.Fatalf("get email = %q", got.Email)
|
||||
}
|
||||
|
||||
updated, err := store.Update(ctx, created.ID, "", "Alice A.")
|
||||
if err != nil {
|
||||
t.Fatalf("update: %v", err)
|
||||
}
|
||||
if updated.Name != "Alice A." || updated.Email != "alice@example.com" {
|
||||
t.Fatalf("update ergebnis unerwartet: %+v", updated)
|
||||
}
|
||||
|
||||
list, err := store.List(ctx)
|
||||
if err != nil {
|
||||
t.Fatalf("list: %v", err)
|
||||
}
|
||||
if len(list) != 1 {
|
||||
t.Fatalf("erwartet 1 benutzer, habe %d", len(list))
|
||||
}
|
||||
|
||||
deactivated, err := store.Deactivate(ctx, created.ID)
|
||||
if err != nil {
|
||||
t.Fatalf("deactivate: %v", err)
|
||||
}
|
||||
if deactivated.Status != StatusInactive {
|
||||
t.Fatalf("erwartet status inactive, hat %q", deactivated.Status)
|
||||
}
|
||||
|
||||
// Negativfall: doppelte E-Mail-Adresse.
|
||||
if _, err := store.Create(ctx, "second@example.com", "Bob"); err != nil {
|
||||
t.Fatalf("create second: %v", err)
|
||||
}
|
||||
if _, err := store.Create(ctx, "second@example.com", "Bob Zwei"); !errors.Is(err, ErrEmailTaken) {
|
||||
t.Fatalf("erwartet ErrEmailTaken, habe %v", err)
|
||||
}
|
||||
|
||||
// Negativfall: fehlender Benutzer.
|
||||
if _, err := store.Get(ctx, created.ID+"-nicht-vorhanden"); err == nil {
|
||||
t.Fatalf("erwartet fehler bei unbekannter/ungueltiger id")
|
||||
}
|
||||
}
|
||||
|
||||
// Akzeptanzkriterium 2 + Pruefung 2: Superadmin-Anlage ohne Tenant-Kontext.
|
||||
// SuperadminStore.Create hat keinen Tenant-Parameter — es gibt syntaktisch
|
||||
// keine Moeglichkeit, hier versehentlich einen Tenant-Sonderfall zu vergessen.
|
||||
func TestSuperadminStore_CreateWithoutTenantContext(t *testing.T) {
|
||||
pool := setupTestDB(t, "test_iam01_superadmins", superadminsSchema)
|
||||
store := NewSuperadminStore(pool)
|
||||
ctx := context.Background()
|
||||
|
||||
created, err := store.Create(ctx, "root@nexarch.internal", "Root")
|
||||
if err != nil {
|
||||
t.Fatalf("create superadmin: %v", err)
|
||||
}
|
||||
if created.Status != StatusActive {
|
||||
t.Fatalf("erwartet status active, hat %q", created.Status)
|
||||
}
|
||||
|
||||
got, err := store.Get(ctx, created.ID)
|
||||
if err != nil {
|
||||
t.Fatalf("get: %v", err)
|
||||
}
|
||||
if got.Email != "root@nexarch.internal" {
|
||||
t.Fatalf("get email = %q", got.Email)
|
||||
}
|
||||
|
||||
if _, err := store.Create(ctx, "root@nexarch.internal", "Root Zwei"); !errors.Is(err, ErrEmailTaken) {
|
||||
t.Fatalf("erwartet ErrEmailTaken (globale eindeutigkeit), habe %v", err)
|
||||
}
|
||||
|
||||
deactivated, err := store.Deactivate(ctx, created.ID)
|
||||
if err != nil {
|
||||
t.Fatalf("deactivate: %v", err)
|
||||
}
|
||||
if deactivated.Status != StatusInactive {
|
||||
t.Fatalf("erwartet status inactive, hat %q", deactivated.Status)
|
||||
}
|
||||
}
|
||||
@@ -1,77 +0,0 @@
|
||||
package user
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
)
|
||||
|
||||
// SuperadminStore verwaltet mandantenuebergreifende Superadmin-Konten in der
|
||||
// Control-Plane-Registry (siehe internal/tenant.Registry). Superadmin-ohne-
|
||||
// Tenant ist dadurch ein eigener Typ statt eines Sonderfalls von User/
|
||||
// TenantUserStore — es gibt keinen Tenant-Parameter, den man weglassen
|
||||
// koennte (IAM-01, "ohne Sonderbehandlung im Code").
|
||||
type SuperadminStore struct {
|
||||
pool *pgxpool.Pool
|
||||
}
|
||||
|
||||
func NewSuperadminStore(pool *pgxpool.Pool) *SuperadminStore {
|
||||
return &SuperadminStore{pool: pool}
|
||||
}
|
||||
|
||||
func (s *SuperadminStore) Create(ctx context.Context, email, name string) (User, error) {
|
||||
if err := ValidateEmail(email); err != nil {
|
||||
return User{}, err
|
||||
}
|
||||
|
||||
var u User
|
||||
u.Email, u.Name, u.Status = email, name, StatusActive
|
||||
|
||||
row := s.pool.QueryRow(ctx, `
|
||||
INSERT INTO superadmins (email, name, status)
|
||||
VALUES ($1, $2, $3)
|
||||
RETURNING id, created_at, updated_at
|
||||
`, u.Email, u.Name, u.Status)
|
||||
|
||||
if err := row.Scan(&u.ID, &u.CreatedAt, &u.UpdatedAt); err != nil {
|
||||
return User{}, mapWriteErr(err)
|
||||
}
|
||||
return u, nil
|
||||
}
|
||||
|
||||
func (s *SuperadminStore) Get(ctx context.Context, id string) (User, error) {
|
||||
return scanUser(s.pool.QueryRow(ctx, `
|
||||
SELECT id, email, name, status, created_at, updated_at
|
||||
FROM superadmins WHERE id = $1
|
||||
`, id))
|
||||
}
|
||||
|
||||
func (s *SuperadminStore) List(ctx context.Context) ([]User, error) {
|
||||
rows, err := s.pool.Query(ctx, `
|
||||
SELECT id, email, name, status, created_at, updated_at
|
||||
FROM superadmins ORDER BY created_at
|
||||
`)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("superadmins auflisten: %w", err)
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
var out []User
|
||||
for rows.Next() {
|
||||
var u User
|
||||
if err := rows.Scan(&u.ID, &u.Email, &u.Name, &u.Status, &u.CreatedAt, &u.UpdatedAt); err != nil {
|
||||
return nil, fmt.Errorf("superadmin lesen: %w", err)
|
||||
}
|
||||
out = append(out, u)
|
||||
}
|
||||
return out, rows.Err()
|
||||
}
|
||||
|
||||
func (s *SuperadminStore) Deactivate(ctx context.Context, id string) (User, error) {
|
||||
return scanUser(s.pool.QueryRow(ctx, `
|
||||
UPDATE superadmins SET status = $2, updated_at = now()
|
||||
WHERE id = $1
|
||||
RETURNING id, email, name, status, created_at, updated_at
|
||||
`, id, StatusInactive))
|
||||
}
|
||||
@@ -1,128 +0,0 @@
|
||||
package user
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
|
||||
"github.com/jackc/pgx/v5"
|
||||
"github.com/jackc/pgx/v5/pgconn"
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
)
|
||||
|
||||
// TenantUserStore verwaltet Benutzer innerhalb GENAU EINER Tenant-Datenbank.
|
||||
// Welcher Mandant gemeint ist, ergibt sich ausschliesslich aus dem
|
||||
// uebergebenen Pool — es gibt keine tenant_id-Spalte (siehe migrations/tenant/0001_users.up.sql).
|
||||
type TenantUserStore struct {
|
||||
pool *pgxpool.Pool
|
||||
}
|
||||
|
||||
func NewTenantUserStore(pool *pgxpool.Pool) *TenantUserStore {
|
||||
return &TenantUserStore{pool: pool}
|
||||
}
|
||||
|
||||
func (s *TenantUserStore) Create(ctx context.Context, email, name string) (User, error) {
|
||||
if err := ValidateEmail(email); err != nil {
|
||||
return User{}, err
|
||||
}
|
||||
|
||||
var u User
|
||||
u.Email, u.Name, u.Status = email, name, StatusActive
|
||||
|
||||
row := s.pool.QueryRow(ctx, `
|
||||
INSERT INTO users (email, name, status)
|
||||
VALUES ($1, $2, $3)
|
||||
RETURNING id, created_at, updated_at
|
||||
`, u.Email, u.Name, u.Status)
|
||||
|
||||
if err := row.Scan(&u.ID, &u.CreatedAt, &u.UpdatedAt); err != nil {
|
||||
return User{}, mapWriteErr(err)
|
||||
}
|
||||
return u, nil
|
||||
}
|
||||
|
||||
func (s *TenantUserStore) Get(ctx context.Context, id string) (User, error) {
|
||||
return scanUser(s.pool.QueryRow(ctx, `
|
||||
SELECT id, email, name, status, created_at, updated_at
|
||||
FROM users WHERE id = $1
|
||||
`, id))
|
||||
}
|
||||
|
||||
func (s *TenantUserStore) List(ctx context.Context) ([]User, error) {
|
||||
rows, err := s.pool.Query(ctx, `
|
||||
SELECT id, email, name, status, created_at, updated_at
|
||||
FROM users ORDER BY created_at
|
||||
`)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("benutzer auflisten: %w", err)
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
var out []User
|
||||
for rows.Next() {
|
||||
var u User
|
||||
if err := rows.Scan(&u.ID, &u.Email, &u.Name, &u.Status, &u.CreatedAt, &u.UpdatedAt); err != nil {
|
||||
return nil, fmt.Errorf("benutzer lesen: %w", err)
|
||||
}
|
||||
out = append(out, u)
|
||||
}
|
||||
return out, rows.Err()
|
||||
}
|
||||
|
||||
// Update aendert Name und E-Mail. Eine leere email/name laesst das jeweilige
|
||||
// Feld unveraendert.
|
||||
func (s *TenantUserStore) Update(ctx context.Context, id, email, name string) (User, error) {
|
||||
if email != "" {
|
||||
if err := ValidateEmail(email); err != nil {
|
||||
return User{}, err
|
||||
}
|
||||
}
|
||||
|
||||
row := s.pool.QueryRow(ctx, `
|
||||
UPDATE users
|
||||
SET email = COALESCE(NULLIF($2, ''), email),
|
||||
name = COALESCE(NULLIF($3, ''), name),
|
||||
updated_at = now()
|
||||
WHERE id = $1
|
||||
RETURNING id, email, name, status, created_at, updated_at
|
||||
`, id, email, name)
|
||||
|
||||
u, err := scanUser(row)
|
||||
if err != nil {
|
||||
return User{}, mapWriteErr(err)
|
||||
}
|
||||
return u, nil
|
||||
}
|
||||
|
||||
// Deactivate setzt den Benutzer auf inaktiv statt ihn zu loeschen.
|
||||
func (s *TenantUserStore) Deactivate(ctx context.Context, id string) (User, error) {
|
||||
return scanUser(s.pool.QueryRow(ctx, `
|
||||
UPDATE users SET status = $2, updated_at = now()
|
||||
WHERE id = $1
|
||||
RETURNING id, email, name, status, created_at, updated_at
|
||||
`, id, StatusInactive))
|
||||
}
|
||||
|
||||
func scanUser(row pgx.Row) (User, error) {
|
||||
var u User
|
||||
if err := row.Scan(&u.ID, &u.Email, &u.Name, &u.Status, &u.CreatedAt, &u.UpdatedAt); err != nil {
|
||||
if errors.Is(err, pgx.ErrNoRows) {
|
||||
return User{}, ErrNotFound
|
||||
}
|
||||
return User{}, fmt.Errorf("benutzer lesen: %w", err)
|
||||
}
|
||||
return u, nil
|
||||
}
|
||||
|
||||
// mapWriteErr uebersetzt den Unique-Constraint-Verstoss der E-Mail-Spalte in
|
||||
// einen sprechenden Fehler statt der rohen Postgres-Fehlermeldung.
|
||||
func mapWriteErr(err error) error {
|
||||
var pgErr *pgconn.PgError
|
||||
if errors.As(err, &pgErr) && pgErr.Code == "23505" {
|
||||
return ErrEmailTaken
|
||||
}
|
||||
if errors.Is(err, pgx.ErrNoRows) {
|
||||
return ErrNotFound
|
||||
}
|
||||
return fmt.Errorf("benutzer schreiben: %w", err)
|
||||
}
|
||||
@@ -1,42 +0,0 @@
|
||||
// Package user implementiert Core IAM-01: das Benutzer-Datenmodell und die
|
||||
// CRUD-Operationen. Tenant-Zugehoerigkeit ist ueber die Zieldatenbank
|
||||
// gegeben (Modell C, siehe internal/tenant) — Superadmin-Konten leben
|
||||
// dagegen mandantenuebergreifend in der Registry und sind ueber
|
||||
// SuperadminStore als eigener, First-Class-Typ modelliert, nicht als
|
||||
// tenant_id-NULL-Sonderfall in User.
|
||||
package user
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"regexp"
|
||||
"time"
|
||||
)
|
||||
|
||||
type Status string
|
||||
|
||||
const (
|
||||
StatusActive Status = "active"
|
||||
StatusInactive Status = "inactive"
|
||||
)
|
||||
|
||||
type User struct {
|
||||
ID string
|
||||
Email string
|
||||
Name string
|
||||
Status Status
|
||||
CreatedAt time.Time
|
||||
UpdatedAt time.Time
|
||||
}
|
||||
|
||||
var emailPattern = regexp.MustCompile(`^[^\s@]+@[^\s@]+\.[^\s@]+$`)
|
||||
|
||||
var ErrInvalidEmail = errors.New("user: ungueltige E-Mail-Adresse")
|
||||
var ErrEmailTaken = errors.New("user: E-Mail-Adresse bereits vergeben")
|
||||
var ErrNotFound = errors.New("user: nicht gefunden")
|
||||
|
||||
func ValidateEmail(email string) error {
|
||||
if !emailPattern.MatchString(email) {
|
||||
return ErrInvalidEmail
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -1,24 +0,0 @@
|
||||
package user
|
||||
|
||||
import "testing"
|
||||
|
||||
func TestValidateEmail(t *testing.T) {
|
||||
cases := []struct {
|
||||
email string
|
||||
wantErr bool
|
||||
}{
|
||||
{"a@b.de", false},
|
||||
{"a.b+c@sub.example.com", false},
|
||||
{"", true},
|
||||
{"keine-email", true},
|
||||
{"a@b", true},
|
||||
{"@b.de", true},
|
||||
}
|
||||
|
||||
for _, c := range cases {
|
||||
err := ValidateEmail(c.email)
|
||||
if (err != nil) != c.wantErr {
|
||||
t.Errorf("ValidateEmail(%q) error = %v, wantErr %v", c.email, err, c.wantErr)
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1 +0,0 @@
|
||||
DROP TABLE IF EXISTS superadmins;
|
||||
@@ -1,14 +0,0 @@
|
||||
-- Superadmin-Konten arbeiten mandantenuebergreifend und leben deshalb in der
|
||||
-- Control-Plane-Registry (siehe TEN-01), nicht in einer Tenant-Datenbank.
|
||||
-- Das bildet "Superadmin ohne Tenant" strukturell als First-Class-Zustand ab,
|
||||
-- statt ihn als Sonderfall in der Tenant-users-Tabelle zu behandeln
|
||||
-- (IAM-01, siehe core-kanban/tickets/IAM-01.md — bekannte Fehler vermeiden).
|
||||
-- E-Mail-Eindeutigkeit ist hier global, da die Registry-DB einmalig existiert.
|
||||
CREATE TABLE superadmins (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
email TEXT NOT NULL UNIQUE,
|
||||
name TEXT NOT NULL,
|
||||
status TEXT NOT NULL DEFAULT 'active',
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||||
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
@@ -1 +0,0 @@
|
||||
DROP TABLE IF EXISTS users;
|
||||
@@ -1,16 +0,0 @@
|
||||
-- Benutzer-Datenmodell (IAM-01, siehe core-kanban/tickets/IAM-01.md).
|
||||
-- Diese Migration laeuft in der DB EINES Mandanten (Modell C, siehe TEN-01) —
|
||||
-- die Tenant-Zugehoerigkeit ist implizit durch die Datenbankverbindung
|
||||
-- gegeben, es gibt daher bewusst KEINE tenant_id-Spalte.
|
||||
-- E-Mail-Eindeutigkeit ist hier tenant-scoped: der UNIQUE-Constraint gilt
|
||||
-- nur innerhalb dieser einen Tenant-Datenbank.
|
||||
CREATE EXTENSION IF NOT EXISTS pgcrypto;
|
||||
|
||||
CREATE TABLE users (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
email TEXT NOT NULL UNIQUE,
|
||||
name TEXT NOT NULL,
|
||||
status TEXT NOT NULL DEFAULT 'active',
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
||||
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
@@ -1,2 +0,0 @@
|
||||
DROP TABLE IF EXISTS role_assignment_history;
|
||||
DROP TABLE IF EXISTS role_assignments;
|
||||
@@ -1,23 +0,0 @@
|
||||
-- Rollenzuweisung pro Benutzer (RBAC-01, siehe core-kanban/tickets/RBAC-01.md).
|
||||
-- Nur 'user' und 'tenant_admin' sind hier zuweisbar — 'superadmin' lebt
|
||||
-- mandantenuebergreifend in der Registry (IAM-01 SuperadminStore) und hat
|
||||
-- daher bewusst KEINE Zeile in dieser tenant-lokalen Tabelle (Akzeptanz-
|
||||
-- kriterium 1: nur Zuweisungen innerhalb der erlaubten Matrix).
|
||||
CREATE TABLE role_assignments (
|
||||
user_id UUID PRIMARY KEY REFERENCES users(id),
|
||||
role TEXT NOT NULL CHECK (role IN ('user', 'tenant_admin')),
|
||||
granted_by TEXT NOT NULL,
|
||||
granted_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
|
||||
-- Vollstaendige Historie jeder Rollenaenderung (Akzeptanzkriterium 3: wer
|
||||
-- hat wann welche Rolle vergeben).
|
||||
CREATE TABLE role_assignment_history (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
user_id UUID NOT NULL,
|
||||
role TEXT NOT NULL,
|
||||
granted_by TEXT NOT NULL,
|
||||
granted_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
||||
);
|
||||
|
||||
CREATE INDEX role_assignment_history_user_idx ON role_assignment_history (user_id, granted_at);
|
||||
@@ -1,23 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Setzt die nexarch-Testumgebung zurueck: loescht die geteilte
|
||||
# Registry-Tabelle "tenants" in der postgres-Wartungsdatenbank sowie alle
|
||||
# tenant_*-Datenbanken. Noetig, weil verschiedene Feature-Branches
|
||||
# unterschiedliche Registry-Schemata erwarten, aber dieselbe physische
|
||||
# Postgres-Instanz auf dem Testhost teilen (siehe [[project-nexarch-test-infra]]).
|
||||
#
|
||||
# Aufruf: NEXARCH_TEST_DB_PASSWORD=... ./scripts/reset-test-env.sh
|
||||
set -euo pipefail
|
||||
|
||||
PASS="${NEXARCH_TEST_DB_PASSWORD:?Setze NEXARCH_TEST_DB_PASSWORD vor dem Aufruf}"
|
||||
ROLE="nexarch_test"
|
||||
|
||||
export PGPASSWORD="$PASS"
|
||||
|
||||
psql -h localhost -U "$ROLE" -d postgres -v ON_ERROR_STOP=1 -c "DROP TABLE IF EXISTS tenants CASCADE;"
|
||||
|
||||
dbs=$(psql -h localhost -U "$ROLE" -d postgres -tAc "SELECT datname FROM pg_database WHERE datname LIKE 'tenant\_%' ESCAPE '\'")
|
||||
for db in $dbs; do
|
||||
psql -h localhost -U "$ROLE" -d postgres -v ON_ERROR_STOP=1 -c "DROP DATABASE IF EXISTS \"${db}\";"
|
||||
done
|
||||
|
||||
echo "Testumgebung zurueckgesetzt: registry-tabelle + $(echo "$dbs" | grep -c . || true) tenant-datenbank(en) entfernt."
|
||||
@@ -1,24 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Ein-Kommando-Pruefung fuer den aktuellen Code-Stand auf dem Testhost:
|
||||
# Registry+Tenant-DBs zuruecksetzen, dann build/vet/test in einem Rutsch.
|
||||
# -p 1 ist Pflicht, da mehrere Pakete dieselbe physische Registry-Tabelle auf
|
||||
# dem Testhost teilen (siehe [[project-nexarch-test-infra]]).
|
||||
#
|
||||
# Aufruf: NEXARCH_TEST_DB_PASSWORD=... ./scripts/run-checks.sh
|
||||
set -euo pipefail
|
||||
|
||||
PASS="${NEXARCH_TEST_DB_PASSWORD:?Setze NEXARCH_TEST_DB_PASSWORD vor dem Aufruf}"
|
||||
cd "$(dirname "$0")/.."
|
||||
|
||||
NEXARCH_TEST_DB_PASSWORD="$PASS" bash scripts/reset-test-env.sh
|
||||
|
||||
export TEST_ADMIN_DSN="postgresql://nexarch_test:${PASS}@localhost:5432/postgres?sslmode=disable"
|
||||
|
||||
echo "== go build =="
|
||||
go build ./...
|
||||
|
||||
echo "== go vet =="
|
||||
go vet ./...
|
||||
|
||||
echo "== go test (-p 1) =="
|
||||
go test ./... -p 1 -count=1
|
||||
Reference in New Issue
Block a user