Add identity profile

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
2025-12-22 10:52:28 +01:00
parent e0225cbbbc
commit 2f7a3a5f76
23 changed files with 1158 additions and 2697 deletions
--- a/pkg/coredata/entity_type_reg.go
+++ b/pkg/coredata/entity_type_reg.go
@@ -72,6 +72,7 @@ const (
 	RightsRequestEntityType                    uint16 = 48
 	StateOfApplicabilityEntityType             uint16 = 49
 	StateOfApplicabilityControlEntityType      uint16 = 50
+	IdentityProfileEntityType                  uint16 = 51
 )

 type EntityInfo struct {
@@ -284,6 +285,10 @@ var entityRegistry = map[uint16]EntityInfo{
 		Model: "StateOfApplicabilityControl",
 		Table: "states_of_applicability_controls",
 	},
+	IdentityProfileEntityType: {
+		Model: "IdentityProfile",
+		Table: "iam_identity_profiles",
+	},
 }

 func EntityTable(entityType uint16) (string, bool) {
--- a/pkg/coredata/identity.go
+++ b/pkg/coredata/identity.go
@@ -35,7 +35,6 @@ type (
 		ID                   gid.GID   `db:"id"`
 		EmailAddress         mail.Addr `db:"email_address"`
 		HashedPassword       []byte    `db:"hashed_password"`
-		FullName             string    `db:"fullname"`
 		EmailAddressVerified bool      `db:"email_address_verified"`
 		SAMLSubject          *string   `db:"saml_subject"`
 		CreatedAt            time.Time `db:"created_at"`
@@ -66,9 +65,8 @@ SELECT
    email_address,
    hashed_password,
    email_address_verified,
-    fullname,
-	created_at,
-	updated_at
+    created_at,
+    updated_at
 FROM
 	identities
 WHERE
@@ -143,7 +141,6 @@ SELECT
    email_address,
    hashed_password,
    email_address_verified,
-    fullname,
    saml_subject,
    created_at,
    updated_at
@@ -186,8 +183,7 @@ SELECT
    id,
    email_address,
    hashed_password,
-	email_address_verified,
-    fullname,
+    email_address_verified,
    saml_subject,
    created_at,
    updated_at
@@ -225,13 +221,12 @@ func (i *Identity) Insert(
 ) error {
 	q := `
 INSERT INTO
-    identities (id, email_address, hashed_password, email_address_verified, fullname, saml_subject, created_at, updated_at)
+    identities (id, email_address, hashed_password, email_address_verified, saml_subject, created_at, updated_at)
 VALUES (
    @identity_id,
    @email_address,
    @hashed_password,
    @email_address_verified,
-    @fullname,
    @saml_subject,
    @created_at,
    @updated_at
@@ -242,7 +237,6 @@ VALUES (
 		"identity_id":            i.ID,
 		"email_address":          i.EmailAddress,
 		"hashed_password":        i.HashedPassword,
-		"fullname":               i.FullName,
 		"saml_subject":           i.SAMLSubject,
 		"created_at":             i.CreatedAt,
 		"updated_at":             i.UpdatedAt,
@@ -273,8 +267,7 @@ SET
    email_address = @email_address,
    email_address_verified = @email_address_verified,
    saml_subject = @saml_subject,
-	fullname = @fullname,
-	hashed_password = @hashed_password,
+    hashed_password = @hashed_password,
    updated_at = @updated_at
 WHERE
    id = @identity_id
@@ -286,7 +279,6 @@ WHERE
 		"email_address_verified": i.EmailAddressVerified,
 		"saml_subject":           i.SAMLSubject,
 		"updated_at":             i.UpdatedAt,
-		"fullname":               i.FullName,
 		"hashed_password":        i.HashedPassword,
 	}

@@ -314,7 +306,6 @@ SELECT
    email_address,
    hashed_password,
    email_address_verified,
-    fullname,
    saml_subject,
    created_at,
    updated_at
--- a/pkg/coredata/identity_profile.go
+++ b/pkg/coredata/identity_profile.go
@@ -0,0 +1,293 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/gid"
+)
+
+type (
+	IdentityProfile struct {
+		ID           gid.GID   `db:"id"`
+		IdentityID   gid.GID   `db:"identity_id"`
+		MembershipID *gid.GID  `db:"membership_id"`
+		FullName     string    `db:"full_name"`
+		CreatedAt    time.Time `db:"created_at"`
+		UpdatedAt    time.Time `db:"updated_at"`
+	}
+
+	IdentityProfiles []*IdentityProfile
+)
+
+func (p *IdentityProfile) IsDefault() bool {
+	return p.MembershipID == nil
+}
+
+// LoadDefaultByIdentityID loads the default profile for an identity (where membership_id is NULL)
+func (p *IdentityProfile) LoadDefaultByIdentityID(
+	ctx context.Context,
+	conn pg.Conn,
+	identityID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    identity_id,
+    membership_id,
+    full_name,
+    created_at,
+    updated_at
+FROM
+    iam_identity_profiles
+WHERE
+	tenant_id IS NULL
+    AND identity_id = @identity_id
+    AND membership_id IS NULL
+LIMIT 1;
+`
+
+	args := pgx.StrictNamedArgs{"identity_id": identityID}
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query default identity profile: %w", err)
+	}
+
+	profile, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[IdentityProfile])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+
+		return fmt.Errorf("cannot collect default identity profile: %w", err)
+	}
+
+	*p = profile
+
+	return nil
+}
+
+// LoadByMembershipID loads the profile for a specific membership
+func (p *IdentityProfile) LoadByMembershipID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	membershipID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    identity_id,
+    membership_id,
+    full_name,
+    created_at,
+    updated_at
+FROM
+    iam_identity_profiles
+WHERE
+	%s
+    AND membership_id = @membership_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"membership_id": membershipID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query identity profile: %w", err)
+	}
+
+	profile, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[IdentityProfile])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+
+		return fmt.Errorf("cannot collect identity profile: %w", err)
+	}
+
+	*p = profile
+
+	return nil
+}
+
+func (p *IdentityProfile) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	profileID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    identity_id,
+    membership_id,
+    full_name,
+    created_at,
+    updated_at
+FROM
+    iam_identity_profiles
+WHERE
+	%s
+    AND id = @profile_id
+LIMIT 1;
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"profile_id": profileID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query identity profile: %w", err)
+	}
+
+	profile, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[IdentityProfile])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+
+		return fmt.Errorf("cannot collect identity profile: %w", err)
+	}
+
+	*p = profile
+
+	return nil
+}
+
+func (p *IdentityProfile) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+) error {
+	q := `
+INSERT INTO
+    iam_identity_profiles (
+        tenant_id,
+        id,
+        identity_id,
+        membership_id,
+        full_name,
+        created_at,
+        updated_at
+    )
+VALUES (
+    @tenant_id,
+    @id,
+    @identity_id,
+    @membership_id,
+    @full_name,
+    @created_at,
+    @updated_at
+)
+`
+
+	args := pgx.StrictNamedArgs{
+		"tenant_id":     p.ID.TenantID().String(),
+		"id":            p.ID,
+		"identity_id":   p.IdentityID,
+		"membership_id": p.MembershipID,
+		"full_name":     p.FullName,
+		"created_at":    p.CreatedAt,
+		"updated_at":    p.UpdatedAt,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot insert identity profile: %w", err)
+	}
+
+	return nil
+}
+
+func (p *IdentityProfile) Update(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+UPDATE
+    iam_identity_profiles
+SET
+    full_name = @full_name,
+    updated_at = @updated_at
+WHERE
+    id = @id
+    AND %s
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"id":         p.ID,
+		"full_name":  p.FullName,
+		"updated_at": p.UpdatedAt,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	result, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot update identity profile: %w", err)
+	}
+
+	if result.RowsAffected() == 0 {
+		return ErrResourceNotFound
+	}
+
+	return nil
+}
+
+func (p *IdentityProfile) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	profileID gid.GID,
+) error {
+	q := `
+DELETE FROM
+    iam_identity_profiles
+WHERE
+    id = @profile_id
+    AND %s
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"profile_id": profileID}
+	maps.Copy(args, scope.SQLArguments())
+
+	result, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot delete identity profile: %w", err)
+	}
+
+	if result.RowsAffected() == 0 {
+		return ErrResourceNotFound
+	}
+
+	return nil
+}
--- a/pkg/coredata/membership.go
+++ b/pkg/coredata/membership.go
@@ -189,7 +189,7 @@ SELECT
    mbr.identity_id,
    mbr.organization_id,
    mbr.role,
-    i.fullname as full_name,
+    COALESCE(mp.full_name, dp.full_name, '') as full_name,
    i.email_address,
    mbr.created_at,
    mbr.updated_at
@@ -197,6 +197,10 @@ FROM
    mbr
 JOIN
    identities i ON mbr.identity_id = i.id
+LEFT JOIN
+    iam_identity_profiles mp ON mp.membership_id = mbr.id
+LEFT JOIN
+    iam_identity_profiles dp ON dp.identity_id = mbr.identity_id AND dp.membership_id IS NULL
 `

 	query = fmt.Sprintf(query, scope.SQLFragment())
@@ -329,7 +333,7 @@ SELECT
    mbr.identity_id,
    mbr.organization_id,
    mbr.role,
-    i.fullname as full_name,
+    COALESCE(mp.full_name, dp.full_name, '') as full_name,
    i.email_address,
    mbr.created_at,
    mbr.updated_at
@@ -337,6 +341,10 @@ FROM
    mbr
 JOIN
    identities i ON mbr.identity_id = i.id
+LEFT JOIN
+    iam_identity_profiles mp ON mp.membership_id = mbr.id
+LEFT JOIN
+    iam_identity_profiles dp ON dp.identity_id = mbr.identity_id AND dp.membership_id IS NULL
 `

 	q = fmt.Sprintf(q, scope.SQLFragment())
@@ -455,7 +463,7 @@ SELECT
    mbr.identity_id,
    mbr.organization_id,
    mbr.role,
-    i.fullname as full_name,
+    COALESCE(mp.full_name, dp.full_name, '') as full_name,
    i.email_address,
    mbr.created_at,
    mbr.updated_at
@@ -463,6 +471,10 @@ FROM
    mbr
 JOIN
    identities i ON mbr.identity_id = i.id
+LEFT JOIN
+    iam_identity_profiles mp ON mp.membership_id = mbr.id
+LEFT JOIN
+    iam_identity_profiles dp ON dp.identity_id = mbr.identity_id AND dp.membership_id IS NULL
 ORDER BY
    mbr.created_at DESC
 `
@@ -520,19 +532,23 @@ SELECT
    created_at,
    updated_at
 FROM (
-    SELECT
-        mbr.id,
-        mbr.identity_id,
-        mbr.organization_id,
-        mbr.role,
-        i.fullname as full_name,
-        i.email_address,
-        mbr.created_at,
-        mbr.updated_at
-    FROM
-        mbr
-    JOIN
-        identities i ON mbr.identity_id = i.id
+	SELECT
+		mbr.id,
+		mbr.identity_id,
+		mbr.organization_id,
+		mbr.role,
+		COALESCE(mp.full_name, dp.full_name, '') as full_name,
+		i.email_address,
+		mbr.created_at,
+		mbr.updated_at
+	FROM
+		mbr
+	JOIN
+		identities i ON mbr.identity_id = i.id
+	LEFT JOIN
+		iam_identity_profiles mp ON mp.membership_id = mbr.id
+	LEFT JOIN
+		iam_identity_profiles dp ON dp.identity_id = mbr.identity_id AND dp.membership_id IS NULL
 ) AS membership_with_identity
 WHERE %s
 `
--- a/pkg/coredata/migrations/20251220T140915Z.sql
+++ b/pkg/coredata/migrations/20251220T140915Z.sql
@@ -0,0 +1,12 @@
+CREATE TABLE iam_identity_profiles (
+    tenant_id        TEXT NOT NULL,
+    id               TEXT NOT NULL PRIMARY KEY,
+    identity_id      TEXT NOT NULL REFERENCES identities(id) ON DELETE CASCADE,
+    membership_id    TEXT REFERENCES iam_memberships(id) ON DELETE CASCADE,
+    full_name        TEXT NOT NULL,
+    created_at       TIMESTAMPTZ NOT NULL,
+    updated_at       TIMESTAMPTZ NOT NULL
+);
+
+CREATE UNIQUE INDEX idx_iam_identity_profiles_default ON iam_identity_profiles(identity_id) WHERE membership_id IS NULL;
+CREATE UNIQUE INDEX idx_iam_identity_profiles_membership ON iam_identity_profiles(membership_id) WHERE membership_id IS NOT NULL;
--- a/pkg/coredata/migrations/20251221T222519Z.sql
+++ b/pkg/coredata/migrations/20251221T222519Z.sql
@@ -0,0 +1,32 @@
+INSERT INTO iam_identity_profiles (tenant_id, id, identity_id, membership_id, full_name, created_at, updated_at)
+SELECT
+    '',
+    generate_gid('\x0000000000000000'::bytea, 51),
+    i.id,
+    NULL,
+    COALESCE(i.fullname, ''),
+    i.created_at,
+    NOW()
+FROM identities i
+WHERE NOT EXISTS (
+    SELECT 1 FROM iam_identity_profiles p 
+    WHERE p.identity_id = i.id AND p.membership_id IS NULL
+);
+
+INSERT INTO iam_identity_profiles (tenant_id, id, identity_id, membership_id, full_name, created_at, updated_at)
+SELECT
+    m.tenant_id,
+    generate_gid(decode_base64_unpadded(m.tenant_id), 51),
+    m.identity_id,
+    m.id,
+    COALESCE(i.fullname, ''),
+    m.created_at,
+    NOW()
+FROM iam_memberships m
+JOIN identities i ON i.id = m.identity_id
+WHERE NOT EXISTS (
+    SELECT 1 FROM iam_identity_profiles p 
+    WHERE p.membership_id = m.id
+);
+
+ALTER TABLE identities DROP COLUMN fullname;