OIDC is pansy's primary login path (Authentik the target IdP); local auth (#4) remains the fallback and both issue the same session cookie. - deps: github.com/coreos/go-oidc/v3 + golang.org/x/oauth2 (both pure Go; CGO stays off). - api/oidc.go: lazy issuer discovery (retried per-request, never crashes a server that also serves local auth), GET /auth/oidc/login builds an authorization-code URL with PKCE S256 + random state + nonce stashed in a short-lived HttpOnly cookie, GET /auth/oidc/callback verifies state (constant-time), exchanges the code with the PKCE verifier, verifies the ID token + nonce, and starts a pansy session. Failures redirect to /login?error=... ; success to /gardens. - service.LoginOIDC: (issuer,subject) match -> login; else *verified* email match -> link onto the existing account; else JIT-create (the IdP gates access, so PANSY_REGISTRATION doesn't apply). Unverified email colliding with an existing account is refused (takeover guard); no email is refused (email is the account key). Reuses the atomic CreateUser. - store: GetUserByOIDC + LinkOIDC (unique-pair backstop). - config: OIDCReady() (needs issuer+client+BaseURL for the redirect URI); /auth/providers now reports oidc from it and defaults the button label to "Sign in with Authentik". OIDC routes are only registered when ready, so an unconfigured instance 404s them. - PANSY_LOCAL_AUTH=false rejects/hides local auth but not OIDC. Tests: service provisioning (JIT, repeat login, link, unverified-collision refusal, no-email, name fallback, works with local auth off); api (routes-absent-when-unconfigured, providers reporting, login redirect with PKCE params + tx cookie via a fake discovery server, callback state/error paths). Smoke-tested: unreachable issuer degrades to error=oidc_unavailable with the server still up and local auth working. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi
182 lines
6.8 KiB
Go
182 lines
6.8 KiB
Go
// Package domain holds pansy's core types: plain structs mirroring the database
|
|
// schema and the sentinel errors the service layer returns. It has no
|
|
// dependencies on store, api, or any framework — every other package depends on
|
|
// it, not the other way around.
|
|
package domain
|
|
|
|
import "errors"
|
|
|
|
// Sentinel errors returned by the service layer and mapped to HTTP status codes
|
|
// by the API layer (404, 403, 409 respectively).
|
|
var (
|
|
// ErrNotFound means the requested entity does not exist (or is invisible to
|
|
// the actor, when we deliberately mask existence).
|
|
ErrNotFound = errors.New("not found")
|
|
// ErrForbidden means the actor is known but lacks permission for the action.
|
|
ErrForbidden = errors.New("forbidden")
|
|
// ErrVersionConflict means the row's version did not match the one supplied
|
|
// with a PATCH/DELETE; the caller should refetch and retry.
|
|
ErrVersionConflict = errors.New("version conflict")
|
|
|
|
// ErrInvalidInput means the caller supplied structurally invalid data (empty
|
|
// required field, malformed value). Mapped to 400.
|
|
ErrInvalidInput = errors.New("invalid input")
|
|
// ErrInvalidCredentials means a login attempt failed. It is deliberately
|
|
// identical for an unknown email and a wrong password so neither can be
|
|
// enumerated. Mapped to 401.
|
|
ErrInvalidCredentials = errors.New("invalid credentials")
|
|
// ErrEmailTaken means registration collided with an existing account's email.
|
|
// Mapped to 409.
|
|
ErrEmailTaken = errors.New("email already registered")
|
|
// ErrRegistrationClosed means local self-service signup is disabled and at
|
|
// least one user already exists (the very first user may always register to
|
|
// bootstrap the instance). Mapped to 403.
|
|
ErrRegistrationClosed = errors.New("registration closed")
|
|
// ErrLocalAuthDisabled means PANSY_LOCAL_AUTH=false, so local register/login
|
|
// are rejected in favor of OIDC. Mapped to 403.
|
|
ErrLocalAuthDisabled = errors.New("local authentication disabled")
|
|
|
|
// ErrOIDCNoEmail means the IdP returned no email claim, so no account can be
|
|
// provisioned (email is the account's unique key). The email scope is required.
|
|
ErrOIDCNoEmail = errors.New("oidc identity has no email")
|
|
// ErrOIDCEmailUnverified means the IdP's email is unverified and it collides
|
|
// with an existing account; auto-linking it would enable account takeover, so
|
|
// it is refused.
|
|
ErrOIDCEmailUnverified = errors.New("oidc email not verified")
|
|
)
|
|
|
|
// Enumerated string values mirrored from the schema CHECK constraints.
|
|
const (
|
|
UnitMetric = "metric"
|
|
UnitImperial = "imperial"
|
|
|
|
RoleViewer = "viewer"
|
|
RoleEditor = "editor"
|
|
|
|
KindBed = "bed"
|
|
KindGrowBag = "grow_bag"
|
|
KindContainer = "container"
|
|
KindInGround = "in_ground"
|
|
KindTree = "tree"
|
|
KindPath = "path"
|
|
KindStructure = "structure"
|
|
|
|
ShapeRect = "rect"
|
|
ShapeCircle = "circle"
|
|
ShapePolygon = "polygon" // reserved for post-v1
|
|
|
|
CategoryVegetable = "vegetable"
|
|
CategoryHerb = "herb"
|
|
CategoryFlower = "flower"
|
|
CategoryFruit = "fruit"
|
|
CategoryTreeShrub = "tree_shrub"
|
|
CategoryCover = "cover"
|
|
)
|
|
|
|
// User is a pansy account. It may have a local password, OIDC identity, or both.
|
|
type User struct {
|
|
ID int64 `json:"id"`
|
|
Email string `json:"email"`
|
|
DisplayName string `json:"displayName"`
|
|
PasswordHash *string `json:"-"` // never serialized
|
|
OIDCIssuer *string `json:"-"`
|
|
OIDCSubject *string `json:"-"`
|
|
IsAdmin bool `json:"isAdmin"`
|
|
Version int64 `json:"version"`
|
|
CreatedAt string `json:"createdAt"`
|
|
UpdatedAt string `json:"updatedAt"`
|
|
}
|
|
|
|
// Session is a server-side session record. The raw token is never stored; only
|
|
// its sha256 hash (the primary key) is.
|
|
type Session struct {
|
|
TokenHash string `json:"-"`
|
|
UserID int64 `json:"userId"`
|
|
ExpiresAt string `json:"expiresAt"`
|
|
CreatedAt string `json:"createdAt"`
|
|
}
|
|
|
|
// Garden is a planning surface owned by one user, at real-world scale (cm).
|
|
type Garden struct {
|
|
ID int64 `json:"id"`
|
|
OwnerID int64 `json:"ownerId"`
|
|
Name string `json:"name"`
|
|
WidthCM float64 `json:"widthCm"`
|
|
HeightCM float64 `json:"heightCm"`
|
|
UnitPref string `json:"unitPref"`
|
|
Notes string `json:"notes"`
|
|
Version int64 `json:"version"`
|
|
CreatedAt string `json:"createdAt"`
|
|
UpdatedAt string `json:"updatedAt"`
|
|
}
|
|
|
|
// GardenShare grants a non-owner user viewer or editor access to a garden.
|
|
type GardenShare struct {
|
|
ID int64 `json:"id"`
|
|
GardenID int64 `json:"gardenId"`
|
|
UserID int64 `json:"userId"`
|
|
Role string `json:"role"`
|
|
CreatedBy int64 `json:"createdBy"`
|
|
Version int64 `json:"version"`
|
|
CreatedAt string `json:"createdAt"`
|
|
UpdatedAt string `json:"updatedAt"`
|
|
}
|
|
|
|
// GardenObject is any placeable object in a garden (bed, container, tree, path…).
|
|
// Positioned by center point + rotation about center, in garden space.
|
|
type GardenObject struct {
|
|
ID int64 `json:"id"`
|
|
GardenID int64 `json:"gardenId"`
|
|
Kind string `json:"kind"`
|
|
Name string `json:"name"`
|
|
Shape string `json:"shape"`
|
|
Points *string `json:"points,omitempty"` // reserved: JSON for polygons
|
|
XCM float64 `json:"xCm"`
|
|
YCM float64 `json:"yCm"`
|
|
WidthCM float64 `json:"widthCm"`
|
|
HeightCM float64 `json:"heightCm"`
|
|
RotationDeg float64 `json:"rotationDeg"`
|
|
ZIndex int `json:"zIndex"`
|
|
Plantable bool `json:"plantable"`
|
|
Color *string `json:"color,omitempty"`
|
|
Props *string `json:"props,omitempty"` // kind-specific JSON
|
|
Notes string `json:"notes"`
|
|
Version int64 `json:"version"`
|
|
CreatedAt string `json:"createdAt"`
|
|
UpdatedAt string `json:"updatedAt"`
|
|
}
|
|
|
|
// Plant is a catalog entry. OwnerID nil means a read-only seeded built-in.
|
|
type Plant struct {
|
|
ID int64 `json:"id"`
|
|
OwnerID *int64 `json:"ownerId,omitempty"` // nil = built-in
|
|
Name string `json:"name"`
|
|
Category string `json:"category"`
|
|
SpacingCM float64 `json:"spacingCm"`
|
|
Color string `json:"color"`
|
|
Icon string `json:"icon"`
|
|
DaysToMaturity *int `json:"daysToMaturity,omitempty"`
|
|
Notes string `json:"notes"`
|
|
Version int64 `json:"version"`
|
|
CreatedAt string `json:"createdAt"`
|
|
UpdatedAt string `json:"updatedAt"`
|
|
}
|
|
|
|
// Planting ("plop") is a circular patch of one plant, positioned in its parent
|
|
// object's local frame. Count nil means it is derived from area / spacing².
|
|
type Planting struct {
|
|
ID int64 `json:"id"`
|
|
ObjectID int64 `json:"objectId"`
|
|
PlantID int64 `json:"plantId"`
|
|
XCM float64 `json:"xCm"`
|
|
YCM float64 `json:"yCm"`
|
|
RadiusCM float64 `json:"radiusCm"`
|
|
Count *int `json:"count,omitempty"` // nil = derived
|
|
Label *string `json:"label,omitempty"`
|
|
PlantedAt *string `json:"plantedAt,omitempty"`
|
|
RemovedAt *string `json:"removedAt,omitempty"`
|
|
Version int64 `json:"version"`
|
|
CreatedAt string `json:"createdAt"`
|
|
UpdatedAt string `json:"updatedAt"`
|
|
}
|