//! User-centric commands that cross both the web and SSH login paths.

//!

//! Extracted from `web/src/handler.rs` so the SSH daemon reuses the

//! exact same password-verification code: same Argon2 parameters,

//! same "invalid email or password" failure mode.

use argon2::{Argon2, PasswordHash, PasswordHasher, PasswordVerifier};

use sqlx::Connection;

use sqlx::types::Uuid;

use std::fmt::Debug;

use super::CmdError;

use crate::config::ConfigError;

use crate::db::get_connection;

use crate::error::ServerError;

/// What a successful [`verify_user_password`] returns. The daemon gates

/// the entire password code path on `ssh_enabled = TRUE`; the web

/// handler ignores that flag since it owns its own login surface.

#[derive(Debug, Clone)]

pub struct VerifiedUser {

    pub user_id: Uuid,

    pub ssh_enabled: bool,

    pub generation: i32,

}

/// Why a session may not proceed, when it may not.

#[derive(Debug, Clone, Copy, PartialEq, Eq)]

pub enum Refusal {

    /// Withheld by the fleet migrator. Transient.

    Quarantined,

    Disabled,

}

/// Whether this user may currently be served, and if not, why.

///

/// Read from the global directory: a database that cannot be reached cannot

/// record its own failure, so neither flag lives in the tenant.

///

/// # Errors

/// Only on infrastructure failure. An unknown user is refused as `Disabled`.

        "SELECT quarantined_at, verified FROM users WHERE id = $1",

        user_id

    )

    else {

    };

    })

/// A directory row plus the reason it may not be served, in one read.

pub struct Account {

    pub id: Uuid,

    pub name: String,

    pub email: String,

    pub role: String,

    pub photo: String,

    pub verified: bool,

    pub created_at: Option<chrono::DateTime<chrono::Utc>>,

    pub updated_at: Option<chrono::DateTime<chrono::Utc>>,

    pub refusal: Option<Refusal>,

}

/// Fetches an account and its serving status.

///

/// The one read every authenticated request already performs, kept in this

/// crate: `web` must not open its own connection to the directory.

///

/// # Errors

/// [`ConfigError::DB`] when the directory is unreachable.

        "SELECT id, user_name as name, email, user_role as role, photo, verified, \

         quarantined_at, created_at, updated_at FROM users WHERE id = $1",

        user_id

    )

        },

/// Whether an email is already registered.

///

/// # Errors

/// [`ConfigError::DB`] when the directory is unreachable.

/// A row to add to the directory.

pub struct NewUser<'a> {

    pub id: Uuid,

    pub name: &'a str,

    pub email: &'a str,

    pub password_hash: &'a str,

    pub database_name: &'a str,

    pub jwt_public_key: &'a str,

}

/// Inserts a directory row for a freshly provisioned tenant.

///

/// `verified` is set here rather than by changing `0003_users.sql`'s default:

/// that migration is applied in the global database and in live tenants, so

/// editing it would change its checksum and fail every boot.

///

/// # Errors

/// [`ConfigError::DB`] when the directory is unreachable, and the underlying

/// sqlx error when the insert itself fails — a concurrent registration winning

/// the `UNIQUE (email)` race reaches the caller as an error so it can drop the

/// database it already provisioned.

        "INSERT INTO users (id,user_name,email,user_password,database_name,jwt_public_key,verified) \

         VALUES ($1, $2, $3, $4, $5, $6, TRUE) \

         RETURNING id, user_name as name, email, user_role as role, photo, verified, created_at, updated_at",

        new.id,

        new.name,

        new.password_hash,

        new.database_name,

        new.jwt_public_key

    )

/// Shared verification helper returning the richer `VerifiedUser`

/// shape. The SSH daemon uses this directly so it can gate the

/// password path on `ssh_enabled`.

///

/// # Errors

///

/// Returns `Err` only on infrastructure failure (DB unavailable).

/// Mismatched credentials resolve to `Ok(None)` — the single failure

/// mode the caller should pattern-match on.

    else {

    };

    };

    // After the hash, not before: an early return would make a disabled

    // account measurably faster to probe than a wrong password.

/// Replaces the password and revokes every outstanding session, in one

/// statement.

///

/// # Errors

/// `CmdError::Args` when the current password does not verify; otherwise only

/// on infrastructure failure.

    // Hashed before taking a connection: Argon2 is deliberately slow and the

    // hash does not depend on the row, so it has no business holding one of

    // the admin pool's five connections.

    //

    // Not `Args`: failing to produce a hash is an infrastructure fault, and the

    // handler turns `Args` into "invalid password", which would send the user

    // off retyping a password that was right.

#[cfg(test)]

mod command_tests {

    use super::*;

    use crate::db::DB_POOL;

    use argon2::{Argon2, PasswordHasher};

    use sqlx::PgPool;

    use supp_macro::local_db_sqlx_test;

    use tokio::sync::OnceCell;

    static CONTEXT: OnceCell<()> = OnceCell::const_new();

    /// A hash the `argon2` CLI produced, with cost parameters deliberately

    /// unlike `Argon2::default()`.

    ///

    /// The break-glass admin is promoted by hand with a hash generated

    /// out-of-band (doc/ops/0006, Phase 4a), and that runbook tells the operator

    /// the cost settings need not match the seeded row. This is what makes that

    /// true: verification reads the parameters out of the PHC string. If it ever

    /// stops being true, the operator finds out during an outage, locked out of

    /// the account they just promoted.

    const CLI_GENERATED_HASH: &str = "$argon2id$v=19$m=4096,t=3,p=1$\

aTltTkFWR2paUHY5Y2pYbVNlR2Rsdz09$QKPc9TsnwNUm7fgdz/JqzHyrYyo4/x2pMvehw5upb8g";

    #[test]

            "the promotion runbook depends on a hash made with other parameters verifying"

        );

        );

                #[cfg(feature = "testlog")]

            "INSERT INTO users (

                id, user_name, email, photo, verified,

                user_password, user_role, database_name, created_at

             ) VALUES (

                $1, 'Test', $2, 'default.png', TRUE,

                $3, 'user', 'db', NOW()

             )",

            id,

            email,

            hash,

        )

    #[local_db_sqlx_test]

    async fn verify_returns_user_on_correct_password(pool: PgPool) -> anyhow::Result<()> {

        let uid = Uuid::new_v4();

        insert_user_with_password(uid, "good@example.com", "hunter2").await?;

        let v = verify_user_password("good@example.com", "hunter2")

            .await?

            .expect("match");

        assert_eq!(v.user_id, uid);

        assert!(!v.ssh_enabled);

    }

    #[local_db_sqlx_test]

    async fn verify_returns_none_on_wrong_password(pool: PgPool) -> anyhow::Result<()> {

        let uid = Uuid::new_v4();

        insert_user_with_password(uid, "wrong@example.com", "hunter2").await?;

        let v = verify_user_password("wrong@example.com", "nope").await?;

        assert!(v.is_none());

    }

    #[local_db_sqlx_test]

    async fn verify_returns_none_for_unknown_email(pool: PgPool) -> anyhow::Result<()> {

        let _ = pool;

        let v = verify_user_password("nobody@example.com", "whatever").await?;

        assert!(v.is_none());

    }

    /// Disable is `verified = FALSE`, and it must close the password path on

    /// both surfaces at once: this function is shared by web login and the SSH

    /// daemon's password auth.

    #[local_db_sqlx_test]

    async fn verify_returns_none_for_a_disabled_user(pool: PgPool) -> anyhow::Result<()> {

        let uid = Uuid::new_v4();

        insert_user_with_password(uid, "off@example.com", "hunter2").await?;

        assert!(

            verify_user_password("off@example.com", "hunter2")

                .await?

                .is_some()

        );

        sqlx::query("UPDATE users SET verified = FALSE WHERE id = $1")

            .bind(uid)

            .execute(&pool)

            .await?;

        assert!(

            verify_user_password("off@example.com", "hunter2")

                .await?

                .is_none()

        );

    }

    /// A password change must replace the hash and bump the generation in one

    /// go: every token carrying the old value stops verifying the moment it

    /// commits.

    #[local_db_sqlx_test]

    async fn change_password_bumps_the_generation(pool: PgPool) -> anyhow::Result<()> {

        let uid = Uuid::new_v4();

        insert_user_with_password(uid, "bump@example.com", "hunter2").await?;

        assert_eq!(generation_of(&pool, uid).await?, 0);

        change_password(uid, "hunter2", "hunter3").await?;

        assert_eq!(generation_of(&pool, uid).await?, 1);

        assert!(

            verify_user_password("bump@example.com", "hunter3")

                .await?

                .is_some(),

            "the new password must work"

        );

        assert!(

            verify_user_password("bump@example.com", "hunter2")

                .await?

                .is_none(),

            "the old password must not"

        );

    }

    /// A wrong current password must change nothing — in particular it must not

    /// bump the generation, which would log the user out of every session.

    #[local_db_sqlx_test]

    async fn change_password_refuses_a_wrong_current(pool: PgPool) -> anyhow::Result<()> {

        let uid = Uuid::new_v4();

        insert_user_with_password(uid, "wrongcur@example.com", "hunter2").await?;

        assert!(change_password(uid, "not-it", "hunter3").await.is_err());

        assert_eq!(generation_of(&pool, uid).await?, 0);

        assert!(

            verify_user_password("wrongcur@example.com", "hunter2")

                .await?

                .is_some(),

            "the original password must still work"

        );

    }

    /// A disabled account must not be able to change its own password: doing so

    /// would let it mint a fresh session generation.

    #[local_db_sqlx_test]

    async fn change_password_refuses_a_disabled_user(pool: PgPool) -> anyhow::Result<()> {

        let uid = Uuid::new_v4();

        insert_user_with_password(uid, "offpw@example.com", "hunter2").await?;

        sqlx::query("UPDATE users SET verified = FALSE WHERE id = $1")

            .bind(uid)

            .execute(&pool)

            .await?;

        assert!(change_password(uid, "hunter2", "hunter3").await.is_err());

        assert_eq!(generation_of(&pool, uid).await?, 0);

    }

    /// The current-password check authorises the write, so it must be part of

    /// it. Two changes racing on the same old password would otherwise both

    /// verify, and the loser's new password would be silently overwritten by a

    /// caller that never knew it.

    #[local_db_sqlx_test]

    async fn change_password_serialises_a_concurrent_change(pool: PgPool) -> anyhow::Result<()> {

        let uid = Uuid::new_v4();

        insert_user_with_password(uid, "race@example.com", "hunter2").await?;

        // Hold the row, so the command blocks on the lock rather than racing it.

        let mut blocker = pool.begin().await?;

        sqlx::query("SELECT user_password FROM users WHERE id = $1 FOR UPDATE")

            .bind(uid)

            .fetch_one(&mut *blocker)

            .await?;

        tokio::time::sleep(std::time::Duration::from_millis(200)).await;

        let winner = Argon2::default()

            .hash_password(b"winner")

            .expect("hash")

            .to_string();

        sqlx::query(

            "UPDATE users SET user_password = $2, session_generation = session_generation + 1 \

             WHERE id = $1",

        )

        .bind(uid)

        .bind(&winner)

        .execute(&mut *blocker)

        .await?;

        blocker.commit().await?;

        assert!(

            racing.await?.is_err(),

            "the old password must not authorise a write once another change has committed"

        );

        assert!(

            verify_user_password("race@example.com", "winner")

                .await?

                .is_some(),

            "the committed change must survive"

        );

        assert!(

            verify_user_password("race@example.com", "loser")

                .await?

                .is_none()

        );

    }

        Ok(

        )

    #[local_db_sqlx_test]

    async fn verify_is_case_insensitive_on_email(pool: PgPool) -> anyhow::Result<()> {

        let uid = Uuid::new_v4();

        insert_user_with_password(uid, "mixed@example.com", "pw").await?;

        let v = verify_user_password("MIXED@EXAMPLE.COM", "pw")

            .await?

            .expect("match");

        assert_eq!(v.user_id, uid);

    }

}