pansy/internal/service/service.go

// Package service is pansy's business-logic seam: all permission checks and
// invariants live here rather than in the HTTP handlers. Resource operations
// take (ctx, actor, args) so every rule is enforced regardless of caller; the
// auth operations here are the exception — they establish the actor, so they
// take credentials rather than one. REST handlers (internal/api) and, later,
// agent tools (internal/agent) are thin adapters over these methods, so both
// inherit the same rules. This file holds the shared plumbing; feature methods
// live alongside it (auth.go, and gardens/objects/… in later issues).
package service

import (
	"context"
	"crypto/rand"
	"crypto/sha256"
	"encoding/base64"
	"encoding/hex"
	"fmt"
	"time"

	"gitea.stevedudenhoeffer.com/steve/pansy/internal/config"
	"gitea.stevedudenhoeffer.com/steve/pansy/internal/store"
	"gitea.stevedudenhoeffer.com/steve/pansy/internal/vision"
)

// timeLayout is the ISO-8601 UTC format used for every full timestamp pansy
// stores (created_at/updated_at/expires_at). It matches the schema's
// strftime('%Y-%m-%dT%H:%M:%SZ') so string comparison (e.g. session expiry) is
// equivalent to time comparison. Date-only fields (planting planted_at/
// removed_at) use dateLayout instead.
const timeLayout = "2006-01-02T15:04:05Z"

// sessionTTL is how long a session lives from its last use (sliding expiry).
const sessionTTL = 30 * 24 * time.Hour

// Service holds the dependencies shared by every operation.
type Service struct {
	store *store.DB
	cfg   *config.Config
	// now is the clock, injectable so tests can advance time (session expiry).
	now func() time.Time
	// dummyHash is a valid argon2id hash Login verifies against when an email is
	// unknown, so response time doesn't reveal whether an account exists. It is
	// produced by timingHash (fixed salt, no RNG) so it is always present — an
	// empty one would silently re-open account enumeration.
	dummyHash string
	// extractPacket reads a photographed seed packet (#81). Injectable so tests
	// can supply a canned packet instead of calling a live vision model — the
	// same reason `now` is injectable. Defaults to vision.Extract.
	extractPacket func(ctx context.Context, apiKey, modelSpec string, jpeg []byte) (vision.SeedPacket, error)
}

// Option customizes a Service at construction. The only current use is injecting
// a seed-packet extractor in tests so they don't call a live vision model.
type Option func(*Service)

// WithPacketExtractor overrides how a photographed seed packet is read (#81).
// Production uses vision.Extract; a test supplies a canned reader.
func WithPacketExtractor(fn func(ctx context.Context, apiKey, modelSpec string, jpeg []byte) (vision.SeedPacket, error)) Option {
	return func(s *Service) { s.extractPacket = fn }
}

// New constructs a Service.
func New(st *store.DB, cfg *config.Config, opts ...Option) *Service {
	s := &Service{
		store:         st,
		cfg:           cfg,
		now:           time.Now,
		dummyHash:     timingHash(),
		extractPacket: vision.Extract,
	}
	for _, o := range opts {
		o(s)
	}
	return s
}

// formatTime renders a time as pansy's canonical UTC string.
func formatTime(t time.Time) string { return t.UTC().Format(timeLayout) }

// parseTime parses a canonical pansy timestamp.
func parseTime(s string) (time.Time, error) { return time.Parse(timeLayout, s) }

// randToken returns nBytes of cryptographic randomness as a URL-safe string.
func randToken(nBytes int) (string, error) {
	b := make([]byte, nBytes)
	if _, err := rand.Read(b); err != nil {
		return "", fmt.Errorf("service: generate token: %w", err)
	}
	return base64.RawURLEncoding.EncodeToString(b), nil
}

// newSessionToken returns a fresh URL-safe random bearer token (32 bytes of
// entropy). The raw token goes in the cookie; only its hash is persisted.
func newSessionToken() (string, error) { return randToken(32) }

// newPublicToken returns a fresh unguessable token for a garden's public share
// link (18 bytes → 144 bits; a 24-char URL segment). Unlike a session token it's
// stored raw (it must be shown back to the owner to copy) and grants only
// read-only access to one garden.
func newPublicToken() (string, error) { return randToken(18) }

// hashToken maps a raw bearer token to the hex sha256 stored as the session's
// primary key.
func hashToken(raw string) string {
	sum := sha256.Sum256([]byte(raw))
	return hex.EncodeToString(sum[:])
}