//! Per-user database provisioning.

//!

//! Each user owns a dedicated Postgres database, reached via `userpool` from

//! the *name* in `users.database_name`. This module creates that database,

//! brings it up to the (DDL-only) schema with the shared migration set, and

//! returns its name for the caller to persist. The DSN is composed at

//! connection time by [`dsn_for`]; a DSN in that column would put a live

//! credential in a row (ADR 0032).

//!

//! Provisioning reuses the admin `DATABASE_URL` connection — Postgres allows a

//! connection to create a *different* database — so no separate maintenance DSN

//! is required. The only prerequisite is that the admin role holds `CREATEDB`.

use crate::db::{DBError, admin_database_url, execute_raw, migrate_url};

use rust_i18n::t;

use sqlx::types::Uuid;

/// Postgres SQLSTATE for `duplicate_database`.

const DUPLICATE_DATABASE: &str = "42P04";

/// Creates and migrates a dedicated database for `user_id`, returning its NAME.

///

/// The name — never a DSN — is what the caller stores in

/// `users.database_name`. A DSN in that column would put a live credential in

/// a row that any `SELECT *` prints; see ADR 0032.

///

/// Idempotent on the `CREATE DATABASE` step: a pre-existing database (SQLSTATE

/// `42P04`) is treated as success so a retried provision after a mid-way

/// failure reuses the same deterministically-named database rather than

/// erroring.

///

/// # Errors

///

/// - [`DBError::MissingUrl`] if `DATABASE_URL` is unset.

/// - [`DBError::NoCreateDb`] if the role lacks `CREATEDB`.

/// - [`DBError::Sqlx`] / [`DBError::Migration`] on other failures.

/// A provisioned tenant database, and whether this call is what created it.

pub struct Provisioned {

    pub database_name: String,

    /// `false` when an existing database was reused (SQLSTATE `42P04`). A

    /// caller compensating for a later failure must not drop in that case: the

    /// data is not ours to destroy.

    pub created: bool,

}

/// [`create_user_database`], reporting whether the database is newly created.

///

/// # Errors

/// As [`create_user_database`].

    // If migration fails after *this call* created the database, drop it so a

    // transient failure doesn't leak an orphaned (un-migrated) per-user

    // database. We must NOT drop when we reused a pre-existing database

    // (42P04): a retry whose migration fails would otherwise destroy data we

    // didn't create.

                "{}",

                       e = drop_err : {})

            );

/// Stores a user's RSA private signing key into their (already-provisioned)

/// per-user database, named by `database_name`. The private key never leaves that database.

///

/// # Errors

/// [`DBError::Sqlx`] on connect or insert failure.

    // Takes the database name, not a DSN: composing it here keeps connection

    // strings — and the credentials in them — inside this module.

    // Upsert on the singleton constraint: the per-user DB holds exactly one

    // signing key for its owner, enforced at the DB level (see 0005), so

    // concurrent calls collide on `singleton` rather than creating duplicates.

/// Drops a user's database, used as compensating cleanup when a step *after*

/// provisioning (e.g. the `users` row insert) fails and would otherwise orphan

/// the just-created database. Best-effort and idempotent (`IF EXISTS`).

///

/// # Errors

/// [`DBError::Sqlx`] if the `DROP DATABASE` itself errors (e.g. the database is

/// still in use); callers typically log and continue rather than failing the

/// original error path.

    // `database_name` is `nomi_user_<hex>` (only `[a-z0-9_]`), so the quoted

    // identifier is injection-safe.

/// Deterministic, injection-safe database name for a user. Derived purely from

/// the UUID's hex (no hyphens), so a retry targets the same database.

/// Postgres SQLSTATE for `insufficient_privilege`.

const INSUFFICIENT_PRIVILEGE: &str = "42501";

/// Issues `CREATE DATABASE` on the admin connection. Returns `true` if this call

/// created the database, `false` if it already existed (SQLSTATE `42P04`, the

/// retry-safe reuse path — the caller still migrates, which is idempotent). An

/// insufficient-privilege error maps to [`DBError::NoCreateDb`]. The boolean

/// lets the caller compensate-drop ONLY databases it actually created.

    // `database_name` is `nomi_user_<hex>` — only `[a-z0-9_]`, so the quoted

    // identifier cannot be abused. CREATE DATABASE forbids bind parameters.

    };

        }

    }

/// Replaces the database (path) component of a Postgres DSN, preserving scheme,

/// credentials, host, port, and query parameters.

///

/// Parses `scheme://authority[/path][?query]`. The authority ends at the first

/// `/` or `?` (whichever comes first), so a DSN with no path but a query

/// (`postgres://user@host?sslmode=require`) is handled correctly — the query is

/// preserved and the new db name is inserted as the path.

/// Composes the connection string for a per-user database.

///

/// The single place a tenant DSN is built. Callers hold names; only this

/// function turns one into something connectable, from the process's own

/// `DATABASE_URL`.

///

/// # Errors

/// [`DBError::MissingUrl`] if `DATABASE_URL` is unset or malformed.

/// The names `dsn_for` will accept.

///

/// # Errors

/// [`DBError::UnsafeDatabaseName`] for anything outside `[a-z0-9_]{1,63}`.

    } else {

    }

/// Whether a name is safe to interpolate into a DSN.

///

/// The value comes from `users.database_name`, and only `database_name()` (hex

/// from a uuid) and `current_database()` ever write it — but this composes a

/// connection string, and sqlx honours parameters like `?host=` inside one. A

/// row reading `x?host=elsewhere` would redirect the admin credential, so the

/// name is checked where it is *used* rather than trusted because of where it

/// is supposed to come from.

    // Split off the query first so a query-only DSN (no path) doesn't fold the

    // query into the authority.

    };

    // Whatever path the original DSN had is dropped; the authority is the part

    // before the first '/'.

#[cfg(test)]

mod tests {

    use super::{is_plain_database_name, swap_database};

    #[test]

        ));

    #[test]

        // sqlx honours parameters inside a connection string, so a directory row

        // carrying one would send the admin credential somewhere else.

    #[test]

    #[test]

        )

            out,

            "postgres://u:p@host:5432/nomi_user_abc?sslmode=require"

        );

    #[test]

    #[test]

}