Rewrite identity and access management

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/trust/trust_center_access_service.go

@@ -25,9 +25,9 @@ import (
 	"go.gearno.de/kit/log"
 	"go.gearno.de/kit/pg"
 	"go.probo.inc/probo/packages/emails"
-	"go.probo.inc/probo/pkg/auth"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/iam"
 	"go.probo.inc/probo/pkg/mail"
 	"go.probo.inc/probo/pkg/probo"
 	"go.probo.inc/probo/pkg/statelesstoken"
@@ -37,14 +37,14 @@ import (
 type (
 	TrustCenterAccessService struct {
 		svc    *TenantService
-		auth   *auth.Service
+		iamSvc *iam.Service
 		logger *log.Logger
 	}
 
 	TrustCenterAccessRequest struct {
 		TrustCenterID      gid.GID
 		Email              mail.Addr
-		Name               *string
+		Name               string
 		DocumentIDs        []gid.GID
 		ReportIDs          []gid.GID
 		TrustCenterFileIDs []gid.GID
@@ -91,151 +91,151 @@ func (s TrustCenterAccessService) Request(
 		return nil, fmt.Errorf("invalid request arguments: %w", err)
 	}
 
-	now := time.Now()
+	var (
+		now         = time.Now()
+		access      *coredata.TrustCenterAccess
+		trustCenter *coredata.TrustCenter
+	)
 
-	var access *coredata.TrustCenterAccess
-	var trustCenter *coredata.TrustCenter
-
-	err := s.svc.pg.WithTx(ctx, func(tx pg.Conn) error {
-		var organizationID gid.GID
-		trustCenter = &coredata.TrustCenter{}
-		if err := trustCenter.LoadByID(ctx, tx, s.svc.scope, req.TrustCenterID); err != nil {
-			return fmt.Errorf("cannot load trust center: %w", err)
-		}
-		organizationID = trustCenter.OrganizationID
-
-		documentIDs := req.DocumentIDs
-		if req.DocumentIDs == nil {
-			var allDocuments coredata.Documents
-			filter := coredata.NewDocumentTrustCenterFilter()
-
-			if err := allDocuments.LoadAllByOrganizationID(ctx, tx, s.svc.scope, organizationID, filter); err != nil {
-				return fmt.Errorf("cannot list documents: %w", err)
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(tx pg.Conn) error {
+			trustCenter = &coredata.TrustCenter{}
+			if err := trustCenter.LoadByID(ctx, tx, s.svc.scope, req.TrustCenterID); err != nil {
+				return fmt.Errorf("cannot load trust center: %w", err)
 			}
 
-			for _, doc := range allDocuments {
-				documentIDs = append(documentIDs, doc.ID)
-			}
-		}
+			// TODO: load document to ensure they are requestable
 
-		reportIDs := req.ReportIDs
-		if req.ReportIDs == nil {
-			var allAudits coredata.Audits
-			auditFilter := coredata.NewAuditTrustCenterFilter()
+			organizationID := trustCenter.OrganizationID
 
-			if err := allAudits.LoadAllByOrganizationID(ctx, tx, s.svc.scope, organizationID, auditFilter); err != nil {
-				return fmt.Errorf("cannot list audits: %w", err)
-			}
+			documentIDs := req.DocumentIDs
+			if req.DocumentIDs == nil {
+				var allDocuments coredata.Documents
+				filter := coredata.NewDocumentTrustCenterFilter()
 
-			for _, audit := range allAudits {
-				if audit.ReportID != nil {
-					reportIDs = append(reportIDs, *audit.ReportID)
+				if err := allDocuments.LoadAllByOrganizationID(ctx, tx, s.svc.scope, organizationID, filter); err != nil {
+					return fmt.Errorf("cannot list documents: %w", err)
+				}
+
+				for _, doc := range allDocuments {
+					documentIDs = append(documentIDs, doc.ID)
 				}
 			}
-		}
 
-		trustCenterFileIDs := req.TrustCenterFileIDs
-		if req.TrustCenterFileIDs == nil {
-			var allTrustCenterFiles coredata.TrustCenterFiles
-			filter := coredata.NewTrustCenterFileFilter(
-				coredata.WithTrustCenterFileVisibilities(coredata.TrustCenterVisibilityPrivate, coredata.TrustCenterVisibilityNone),
-			)
+			reportIDs := req.ReportIDs
+			if req.ReportIDs == nil {
+				var allAudits coredata.Audits
+				auditFilter := coredata.NewAuditTrustCenterFilter()
 
-			if err := allTrustCenterFiles.LoadAllByOrganizationID(ctx, tx, s.svc.scope, organizationID, filter); err != nil {
-				return fmt.Errorf("cannot list trust center files: %w", err)
+				if err := allAudits.LoadAllByOrganizationID(ctx, tx, s.svc.scope, organizationID, auditFilter); err != nil {
+					return fmt.Errorf("cannot list audits: %w", err)
+				}
+
+				for _, audit := range allAudits {
+					if audit.ReportID != nil {
+						reportIDs = append(reportIDs, *audit.ReportID)
+					}
+				}
 			}
 
-			for _, file := range allTrustCenterFiles {
-				trustCenterFileIDs = append(trustCenterFileIDs, file.ID)
-			}
-		}
+			trustCenterFileIDs := req.TrustCenterFileIDs
+			if req.TrustCenterFileIDs == nil {
+				var allTrustCenterFiles coredata.TrustCenterFiles
+				filter := coredata.NewTrustCenterFileFilter(
+					coredata.WithTrustCenterFileVisibilities(coredata.TrustCenterVisibilityPrivate, coredata.TrustCenterVisibilityNone),
+				)
 
-		existingAccess := &coredata.TrustCenterAccess{}
-		err := existingAccess.LoadByTrustCenterIDAndEmail(ctx, tx, s.svc.scope, req.TrustCenterID, req.Email)
+				if err := allTrustCenterFiles.LoadAllByOrganizationID(ctx, tx, s.svc.scope, organizationID, filter); err != nil {
+					return fmt.Errorf("cannot list trust center files: %w", err)
+				}
 
-		if err == nil {
-			access = existingAccess
-		} else {
-			var notFoundErr *coredata.ErrTrustCenterAccessNotFound
-			if !errors.As(err, &notFoundErr) {
-				return fmt.Errorf("cannot load trust center access: %w", err)
+				for _, file := range allTrustCenterFiles {
+					trustCenterFileIDs = append(trustCenterFileIDs, file.ID)
+				}
 			}
 
-			if req.Name == nil || *req.Name == "" {
-				return fmt.Errorf("name is required for new access requests")
+			existingAccess := &coredata.TrustCenterAccess{}
+			err := existingAccess.LoadByTrustCenterIDAndEmail(ctx, tx, s.svc.scope, req.TrustCenterID, req.Email)
+			if err == nil {
+				access = existingAccess
+			} else {
+				if !errors.Is(err, coredata.ErrResourceNotFound) {
+					return fmt.Errorf("cannot load trust center access: %w", err)
+				}
+
+				access = &coredata.TrustCenterAccess{
+					ID:                                gid.New(s.svc.scope.GetTenantID(), coredata.TrustCenterAccessEntityType),
+					OrganizationID:                    organizationID,
+					TenantID:                          s.svc.scope.GetTenantID(),
+					TrustCenterID:                     req.TrustCenterID,
+					Email:                             req.Email,
+					Name:                              req.Name,
+					Active:                            false,
+					HasAcceptedNonDisclosureAgreement: false,
+					CreatedAt:                         now,
+					UpdatedAt:                         now,
+				}
+
+				if err := access.Insert(ctx, tx, s.svc.scope); err != nil {
+					return fmt.Errorf("cannot insert trust center access: %w", err)
+				}
 			}
 
-			access = &coredata.TrustCenterAccess{
-				ID:                                gid.New(s.svc.scope.GetTenantID(), coredata.TrustCenterAccessEntityType),
-				OrganizationID:                    organizationID,
-				TenantID:                          s.svc.scope.GetTenantID(),
-				TrustCenterID:                     req.TrustCenterID,
-				Email:                             req.Email,
-				Name:                              *req.Name,
-				Active:                            false,
-				HasAcceptedNonDisclosureAgreement: false,
-				CreatedAt:                         now,
-				UpdatedAt:                         now,
+			var existingAccesses coredata.TrustCenterDocumentAccesses
+			if err := existingAccesses.LoadAllByTrustCenterAccessID(ctx, tx, s.svc.scope, access.ID); err != nil {
+				return fmt.Errorf("cannot load existing access records: %w", err)
 			}
 
-			if err := access.Insert(ctx, tx, s.svc.scope); err != nil {
-				return fmt.Errorf("cannot insert trust center access: %w", err)
+			existingDocumentIDs, existingReportIDs, existingTrustCenterFileIDs := extractExistingIDs(existingAccesses)
+			newDocumentIDs := filterExistingIDs(documentIDs, existingDocumentIDs)
+			newReportIDs := filterExistingIDs(reportIDs, existingReportIDs)
+			newTrustCenterFileIDs := filterExistingIDs(trustCenterFileIDs, existingTrustCenterFileIDs)
+
+			var accesses coredata.TrustCenterDocumentAccesses
+
+			if err := accesses.BulkInsertDocumentAccesses(
+				ctx,
+				tx,
+				s.svc.scope,
+				access.ID,
+				access.OrganizationID,
+				newDocumentIDs,
+				coredata.TrustCenterDocumentAccessStatusRequested,
+				now,
+			); err != nil {
+				return fmt.Errorf("cannot bulk insert trust center document accesses: %w", err)
 			}
-		}
 
-		var existingAccesses coredata.TrustCenterDocumentAccesses
-		if err := existingAccesses.LoadAllByTrustCenterAccessID(ctx, tx, s.svc.scope, access.ID); err != nil {
-			return fmt.Errorf("cannot load existing access records: %w", err)
-		}
+			if err := accesses.BulkInsertReportAccesses(
+				ctx,
+				tx,
+				s.svc.scope,
+				access.ID,
+				access.OrganizationID,
+				newReportIDs,
+				coredata.TrustCenterDocumentAccessStatusRequested,
+				now,
+			); err != nil {
+				return fmt.Errorf("cannot bulk insert trust center report accesses: %w", err)
+			}
 
-		existingDocumentIDs, existingReportIDs, existingTrustCenterFileIDs := extractExistingIDs(existingAccesses)
-		newDocumentIDs := filterExistingIDs(documentIDs, existingDocumentIDs)
-		newReportIDs := filterExistingIDs(reportIDs, existingReportIDs)
-		newTrustCenterFileIDs := filterExistingIDs(trustCenterFileIDs, existingTrustCenterFileIDs)
+			if err := accesses.BulkInsertTrustCenterFileAccesses(
+				ctx,
+				tx,
+				s.svc.scope,
+				access.ID,
+				access.OrganizationID,
+				newTrustCenterFileIDs,
+				coredata.TrustCenterDocumentAccessStatusRequested,
+				now,
+			); err != nil {
+				return fmt.Errorf("cannot bulk insert trust center file accesses: %w", err)
+			}
 
-		var accesses coredata.TrustCenterDocumentAccesses
-
-		if err := accesses.BulkInsertDocumentAccesses(
-			ctx,
-			tx,
-			s.svc.scope,
-			access.ID,
-			access.OrganizationID,
-			newDocumentIDs,
-			coredata.TrustCenterDocumentAccessStatusRequested,
-			now,
-		); err != nil {
-			return fmt.Errorf("cannot bulk insert trust center document accesses: %w", err)
-		}
-
-		if err := accesses.BulkInsertReportAccesses(
-			ctx,
-			tx,
-			s.svc.scope,
-			access.ID,
-			access.OrganizationID,
-			newReportIDs,
-			coredata.TrustCenterDocumentAccessStatusRequested,
-			now,
-		); err != nil {
-			return fmt.Errorf("cannot bulk insert trust center report accesses: %w", err)
-		}
-
-		if err := accesses.BulkInsertTrustCenterFileAccesses(
-			ctx,
-			tx,
-			s.svc.scope,
-			access.ID,
-			access.OrganizationID,
-			newTrustCenterFileIDs,
-			coredata.TrustCenterDocumentAccessStatusRequested,
-			now,
-		); err != nil {
-			return fmt.Errorf("cannot bulk insert trust center file accesses: %w", err)
-		}
-
-		return nil
-	})
+			return nil
+		},
+	)
 
 	if err != nil {
 		return nil, err