Sharing backend: shares CRUD + ACL enforcement everywhere (#16)

Co-authored-by: Steve Dudenhoeffer <[email protected]>

internal/store/gardens.go

@@ -23,7 +23,20 @@ func scanGarden(s scanner) (*domain.Garden, error) {
 	return &g, nil
 }
 
-// maxGardensListed caps ListGardensForOwner as a defensive backstop against a
+// scanGardenWithRole reads a garden row plus a trailing my_role column into the
+// computed Garden.MyRole field (used by the actor-scoped list).
+func scanGardenWithRole(s scanner) (*domain.Garden, error) {
+	var g domain.Garden
+	if err := s.Scan(
+		&g.ID, &g.OwnerID, &g.Name, &g.WidthCM, &g.HeightCM,
+		&g.UnitPref, &g.Notes, &g.Version, &g.CreatedAt, &g.UpdatedAt, &g.MyRole,
+	); err != nil {
+		return nil, err
+	}
+	return &g, nil
+}
+
+// maxGardensListed caps the gardens list as a defensive backstop against a
 // pathologically large result. At household scale a user has a handful of
 // gardens, so this is never hit; genuine pagination is post-v1 if ever needed.
 const maxGardensListed = 1000
@@ -56,13 +69,21 @@ func (d *DB) GetGarden(ctx context.Context, id int64) (*domain.Garden, error) {
 	return g, nil
 }
 
-// ListGardensForOwner returns the gardens owned by ownerID, newest first. The
-// slice is always non-nil (an empty list, not null). Shared-with-me gardens are
-// added in #16.
-func (d *DB) ListGardensForOwner(ctx context.Context, ownerID int64) ([]domain.Garden, error) {
+// ListGardensForActor returns the gardens an actor can see — those they own
+// (my_role "owner") plus those shared with them (my_role = the share's role) —
+// newest first. Always a non-nil slice.
+func (d *DB) ListGardensForActor(ctx context.Context, actorID int64) ([]domain.Garden, error) {
 	rows, err := d.sql.QueryContext(ctx,
-		`SELECT `+gardenColumns+` FROM gardens WHERE owner_id = ? ORDER BY created_at DESC, id DESC LIMIT ?`,
-		ownerID, maxGardensListed,
+		`SELECT `+gardenColumns+`, my_role FROM (
+		     SELECT `+gardenColumns+`, 'owner' AS my_role FROM gardens WHERE owner_id = ?
+		     UNION ALL
+		     SELECT `+qualifyColumns("g", gardenColumns)+`, s.role AS my_role
+		       FROM gardens g JOIN garden_shares s ON s.garden_id = g.id
+		      WHERE s.user_id = ?
+		 )
+		 ORDER BY created_at DESC, id DESC
+		 LIMIT ?`,
+		actorID, actorID, maxGardensListed,
 	)
 	if err != nil {
 		return nil, fmt.Errorf("store: list gardens: %w", err)
@@ -71,7 +92,7 @@ func (d *DB) ListGardensForOwner(ctx context.Context, ownerID int64) ([]domain.G
 
 	gardens := []domain.Garden{}
 	for rows.Next() {
-		g, err := scanGarden(rows)
+		g, err := scanGardenWithRole(rows)
 		if err != nil {
 			return nil, fmt.Errorf("store: scan garden: %w", err)
 		}

internal/store/shares.go

@@ -0,0 +1,134 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+
+	"gitea.stevedudenhoeffer.com/steve/pansy/internal/domain"
+)
+
+// shareColumns lists garden_shares columns in the order scanShare expects.
+const shareColumns = `id, garden_id, user_id, role, created_by, version, created_at, updated_at`
+
+func scanShare(s scanner) (*domain.GardenShare, error) {
+	var sh domain.GardenShare
+	if err := s.Scan(
+		&sh.ID, &sh.GardenID, &sh.UserID, &sh.Role, &sh.CreatedBy,
+		&sh.Version, &sh.CreatedAt, &sh.UpdatedAt,
+	); err != nil {
+		return nil, err
+	}
+	return &sh, nil
+}
+
+// GetShareRole returns the role a user holds on a garden via a share row, and
+// whether such a row exists. Owner access is NOT a share row (it's implicit via
+// gardens.owner_id) — this only reports viewer/editor grants. It is the lookup
+// requireGardenRole uses to consult shares.
+func (d *DB) GetShareRole(ctx context.Context, gardenID, userID int64) (role string, found bool, err error) {
+	err = d.sql.QueryRowContext(ctx,
+		`SELECT role FROM garden_shares WHERE garden_id = ? AND user_id = ?`, gardenID, userID,
+	).Scan(&role)
+	if errors.Is(err, sql.ErrNoRows) {
+		return "", false, nil
+	}
+	if err != nil {
+		return "", false, fmt.Errorf("store: get share role: %w", err)
+	}
+	return role, true, nil
+}
+
+// maxSharesListed bounds a garden's share list defensively (a garden is shared
+// with a handful of people at household scale; this is never hit).
+const maxSharesListed = 1000
+
+// ListSharesForGarden returns a garden's shares joined with each recipient's
+// email and display name, for the sharing UI. Always a non-nil slice.
+func (d *DB) ListSharesForGarden(ctx context.Context, gardenID int64) ([]domain.ShareWithUser, error) {
+	rows, err := d.sql.QueryContext(ctx,
+		`SELECT `+qualifyColumns("s", shareColumns)+`, u.email, u.display_name
+		   FROM garden_shares s JOIN users u ON u.id = s.user_id
+		  WHERE s.garden_id = ?
+		  ORDER BY u.display_name COLLATE NOCASE, s.id
+		  LIMIT ?`,
+		gardenID, maxSharesListed,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("store: list shares: %w", err)
+	}
+	defer rows.Close()
+
+	shares := []domain.ShareWithUser{}
+	for rows.Next() {
+		var sh domain.ShareWithUser
+		if err := rows.Scan(
+			&sh.ID, &sh.GardenID, &sh.UserID, &sh.Role, &sh.CreatedBy,
+			&sh.Version, &sh.CreatedAt, &sh.UpdatedAt, &sh.Email, &sh.DisplayName,
+		); err != nil {
+			return nil, fmt.Errorf("store: scan share: %w", err)
+		}
+		shares = append(shares, sh)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("store: iterate shares: %w", err)
+	}
+	return shares, nil
+}
+
+// CreateShare inserts a share (fields validated by the service) and returns the
+// stored row. A duplicate (garden_id, user_id) trips the UNIQUE index and maps to
+// domain.ErrShareExists.
+func (d *DB) CreateShare(ctx context.Context, sh *domain.GardenShare) (*domain.GardenShare, error) {
+	created, err := scanShare(d.sql.QueryRowContext(ctx,
+		`INSERT INTO garden_shares (garden_id, user_id, role, created_by)
+		 VALUES (?, ?, ?, ?)
+		 RETURNING `+shareColumns,
+		sh.GardenID, sh.UserID, sh.Role, sh.CreatedBy,
+	))
+	if err != nil {
+		if isUniqueViolation(err) {
+			return nil, domain.ErrShareExists
+		}
+		return nil, fmt.Errorf("store: insert share: %w", err)
+	}
+	return created, nil
+}
+
+// UpdateShareRole changes a share's role, returning the updated row or
+// domain.ErrNotFound if no such share exists.
+func (d *DB) UpdateShareRole(ctx context.Context, gardenID, userID int64, role string) (*domain.GardenShare, error) {
+	updated, err := scanShare(d.sql.QueryRowContext(ctx,
+		`UPDATE garden_shares
+		    SET role = ?, version = version + 1,
+		        updated_at = strftime('%Y-%m-%dT%H:%M:%SZ', 'now')
+		  WHERE garden_id = ? AND user_id = ?
+		  RETURNING `+shareColumns,
+		role, gardenID, userID,
+	))
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, domain.ErrNotFound
+	}
+	if err != nil {
+		return nil, fmt.Errorf("store: update share role: %w", err)
+	}
+	return updated, nil
+}
+
+// DeleteShare removes a share. Returns domain.ErrNotFound if no row was deleted.
+func (d *DB) DeleteShare(ctx context.Context, gardenID, userID int64) error {
+	res, err := d.sql.ExecContext(ctx,
+		`DELETE FROM garden_shares WHERE garden_id = ? AND user_id = ?`, gardenID, userID)
+	if err != nil {
+		return fmt.Errorf("store: delete share: %w", err)
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("store: share delete rows: %w", err)
+	}
+	if n == 0 {
+		return domain.ErrNotFound
+	}
+	return nil
+}