pansy/internal/service/gardens.go

package service

import (
	"context"
	"math"
	"strings"

	"gitea.stevedudenhoeffer.com/steve/pansy/internal/domain"
)

// Garden sizing and field bounds. A new garden with no dimensions defaults to a
// 10 m square; dimensions must be finite and within [1 cm, 100 m] — a generous
// sanity range that also rejects NaN/Inf and absurd values. Name/notes are
// length-capped so untrusted input can't balloon storage.
const (
	defaultGardenCM   = 1000   // 10 m
	minGardenCM       = 1      // 1 cm
	maxGardenCM       = 10_000 // 100 m
	maxGardenNameLen  = 200
	maxGardenNotesLen = 10_000
)

// gardenRole ranks a user's access to a garden. Higher includes lower
// (owner can do anything an editor can, etc.). Until sharing (#16), the only
// role anyone holds is owner, on their own gardens.
type gardenRole int

const (
	roleNone gardenRole = iota
	roleViewer
	roleEditor
	roleOwner
)

// GardenInput is the mutable field set for creating or updating a garden.
type GardenInput struct {
	Name     string
	WidthCM  float64
	HeightCM float64
	UnitPref string
	Notes    string
}

// requireGardenRole loads a garden and enforces that the actor holds at least
// min. It is THE place authorization for a garden is decided — REST handlers and
// future agent tools both funnel through here, so neither can skip a check.
//
// A user with no role at all gets ErrNotFound rather than ErrForbidden: we don't
// reveal that a garden exists to someone with no access. A user who has some
// access but not enough (e.g. a viewer trying to edit, once #16 lands) gets
// ErrForbidden. #16 extends effectiveRole to consult garden_shares.
func (s *Service) requireGardenRole(ctx context.Context, actorID, gardenID int64, min gardenRole) (*domain.Garden, error) {
	g, err := s.store.GetGarden(ctx, gardenID)
	if err != nil {
		return nil, err // ErrNotFound or a real error
	}
	role := effectiveGardenRole(actorID, g)
	if role == roleNone {
		return nil, domain.ErrNotFound
	}
	if role < min {
		return nil, domain.ErrForbidden
	}
	return g, nil
}

// effectiveGardenRole is the actor's role on a garden. Owner is implicit via
// gardens.owner_id; share-based viewer/editor roles are added in #16.
func effectiveGardenRole(actorID int64, g *domain.Garden) gardenRole {
	if g.OwnerID == actorID {
		return roleOwner
	}
	return roleNone
}

// CreateGarden creates a garden owned by the actor. Missing dimensions default
// to a 10 m square; unit defaults to metric.
func (s *Service) CreateGarden(ctx context.Context, actorID int64, in GardenInput) (*domain.Garden, error) {
	g, err := gardenFromInput(in, true)
	if err != nil {
		return nil, err
	}
	g.OwnerID = actorID
	return s.store.CreateGarden(ctx, g)
}

// GetGarden returns a garden the actor may at least view.
func (s *Service) GetGarden(ctx context.Context, actorID, gardenID int64) (*domain.Garden, error) {
	return s.requireGardenRole(ctx, actorID, gardenID, roleViewer)
}

// ListGardens returns the gardens the actor can see. Owned-only until #16.
func (s *Service) ListGardens(ctx context.Context, actorID int64) ([]domain.Garden, error) {
	return s.store.ListGardensForOwner(ctx, actorID)
}

// UpdateGarden applies a version-guarded update; the actor must be at least an
// editor. On a version mismatch it returns (current garden, ErrVersionConflict)
// so the handler can return the fresh row for the client to rebase.
func (s *Service) UpdateGarden(ctx context.Context, actorID, gardenID int64, in GardenInput, version int64) (*domain.Garden, error) {
	if _, err := s.requireGardenRole(ctx, actorID, gardenID, roleEditor); err != nil {
		return nil, err
	}
	g, err := gardenFromInput(in, false) // no defaults: an update states every field
	if err != nil {
		return nil, err
	}
	g.ID = gardenID
	g.Version = version
	return s.store.UpdateGarden(ctx, g)
}

// DeleteGarden removes a garden; only the owner may.
func (s *Service) DeleteGarden(ctx context.Context, actorID, gardenID int64) error {
	if _, err := s.requireGardenRole(ctx, actorID, gardenID, roleOwner); err != nil {
		return err
	}
	return s.store.DeleteGarden(ctx, gardenID)
}

// gardenFromInput validates and normalizes input into a domain.Garden (without
// identity/ownership fields). With applyDefaults, absent dimensions/unit are
// filled in (create); without it, every field must be supplied (update).
func gardenFromInput(in GardenInput, applyDefaults bool) (*domain.Garden, error) {
	name := strings.TrimSpace(in.Name)
	if name == "" || len(name) > maxGardenNameLen {
		return nil, domain.ErrInvalidInput
	}
	notes := strings.TrimSpace(in.Notes)
	if len(notes) > maxGardenNotesLen {
		return nil, domain.ErrInvalidInput
	}

	// 0 means "unset": defaulted on create, rejected on update. Anything else
	// must be a finite length in range — this also rejects negatives, NaN, Inf,
	// and subnormal-tiny values (which are > 0 but below 1 cm).
	width, height := in.WidthCM, in.HeightCM
	if applyDefaults {
		if width == 0 {
			width = defaultGardenCM
		}
		if height == 0 {
			height = defaultGardenCM
		}
	}
	if !validDimensionCM(width) || !validDimensionCM(height) {
		return nil, domain.ErrInvalidInput
	}

	unit := in.UnitPref
	if unit == "" && applyDefaults {
		unit = domain.UnitMetric
	}
	if unit != domain.UnitMetric && unit != domain.UnitImperial {
		return nil, domain.ErrInvalidInput
	}

	return &domain.Garden{
		Name:     name,
		WidthCM:  width,
		HeightCM: height,
		UnitPref: unit,
		Notes:    notes,
	}, nil
}

// validDimensionCM reports whether v is a finite length within the allowed
// garden range. Guards against NaN/Inf (which slip past naive < / > comparisons)
// and subnormal-tiny positives.
func validDimensionCM(v float64) bool {
	return !math.IsNaN(v) && !math.IsInf(v, 0) && v >= minGardenCM && v <= maxGardenCM
}