pansy/internal/store/gardens.go

package store

import (
	"context"
	"database/sql"
	"errors"
	"fmt"

	"gitea.stevedudenhoeffer.com/steve/pansy/internal/domain"
)

// gardenColumns lists the gardens columns in the fixed order scanGarden expects.
const gardenColumns = `id, owner_id, name, width_cm, height_cm, unit_pref, notes, version, created_at, updated_at`

func scanGarden(s scanner) (*domain.Garden, error) {
	var g domain.Garden
	if err := s.Scan(
		&g.ID, &g.OwnerID, &g.Name, &g.WidthCM, &g.HeightCM,
		&g.UnitPref, &g.Notes, &g.Version, &g.CreatedAt, &g.UpdatedAt,
	); err != nil {
		return nil, err
	}
	return &g, nil
}

// scanGardenWithRole reads a garden row plus a trailing my_role column into the
// computed Garden.MyRole field (used by the actor-scoped list).
func scanGardenWithRole(s scanner) (*domain.Garden, error) {
	var g domain.Garden
	if err := s.Scan(
		&g.ID, &g.OwnerID, &g.Name, &g.WidthCM, &g.HeightCM,
		&g.UnitPref, &g.Notes, &g.Version, &g.CreatedAt, &g.UpdatedAt, &g.MyRole,
	); err != nil {
		return nil, err
	}
	return &g, nil
}

// maxGardensListed caps the gardens list as a defensive backstop against a
// pathologically large result. At household scale a user has a handful of
// gardens, so this is never hit; genuine pagination is post-v1 if ever needed.
const maxGardensListed = 1000

// CreateGarden inserts a garden (owner_id, name, dimensions, unit, notes already
// set and validated by the service) and returns the stored row.
func (d *DB) CreateGarden(ctx context.Context, g *domain.Garden) (*domain.Garden, error) {
	created, err := scanGarden(d.sql.QueryRowContext(ctx,
		`INSERT INTO gardens (owner_id, name, width_cm, height_cm, unit_pref, notes)
		 VALUES (?, ?, ?, ?, ?, ?)
		 RETURNING `+gardenColumns,
		g.OwnerID, g.Name, g.WidthCM, g.HeightCM, g.UnitPref, g.Notes,
	))
	if err != nil {
		return nil, fmt.Errorf("store: insert garden: %w", err)
	}
	return created, nil
}

// GetGarden returns the garden with the given id, or domain.ErrNotFound.
func (d *DB) GetGarden(ctx context.Context, id int64) (*domain.Garden, error) {
	g, err := scanGarden(d.sql.QueryRowContext(ctx,
		`SELECT `+gardenColumns+` FROM gardens WHERE id = ?`, id))
	if errors.Is(err, sql.ErrNoRows) {
		return nil, domain.ErrNotFound
	}
	if err != nil {
		return nil, fmt.Errorf("store: get garden: %w", err)
	}
	return g, nil
}

// ListGardensForActor returns the gardens an actor can see — those they own
// (my_role "owner") plus those shared with them (my_role = the share's role) —
// newest first. Always a non-nil slice.
func (d *DB) ListGardensForActor(ctx context.Context, actorID int64) ([]domain.Garden, error) {
	rows, err := d.sql.QueryContext(ctx,
		`SELECT `+gardenColumns+`, my_role FROM (
		     SELECT `+gardenColumns+`, 'owner' AS my_role FROM gardens WHERE owner_id = ?
		     UNION ALL
		     SELECT `+qualifyColumns("g", gardenColumns)+`, s.role AS my_role
		       FROM gardens g JOIN garden_shares s ON s.garden_id = g.id
		      WHERE s.user_id = ?
		 )
		 ORDER BY created_at DESC, id DESC
		 LIMIT ?`,
		actorID, actorID, maxGardensListed,
	)
	if err != nil {
		return nil, fmt.Errorf("store: list gardens: %w", err)
	}
	defer rows.Close()

	gardens := []domain.Garden{}
	for rows.Next() {
		g, err := scanGardenWithRole(rows)
		if err != nil {
			return nil, fmt.Errorf("store: scan garden: %w", err)
		}
		gardens = append(gardens, *g)
	}
	if err := rows.Err(); err != nil {
		return nil, fmt.Errorf("store: iterate gardens: %w", err)
	}
	return gardens, nil
}

// UpdateGarden applies a version-guarded update (optimistic concurrency): the row
// is written only if its stored version matches g.Version, and version is
// incremented on success. It returns:
//   - the updated row, on success;
//   - (current row, domain.ErrVersionConflict) when the version didn't match, so
//     the caller can hand the fresh row back to the client to rebase;
//   - (nil, domain.ErrNotFound) if the row no longer exists.
//
// This is the sync contract every mutable resource in pansy follows.
func (d *DB) UpdateGarden(ctx context.Context, g *domain.Garden) (*domain.Garden, error) {
	updated, err := scanGarden(d.sql.QueryRowContext(ctx,
		`UPDATE gardens
		    SET name = ?, width_cm = ?, height_cm = ?, unit_pref = ?, notes = ?,
		        version = version + 1,
		        updated_at = strftime('%Y-%m-%dT%H:%M:%SZ', 'now')
		  WHERE id = ? AND version = ?
		  RETURNING `+gardenColumns,
		g.Name, g.WidthCM, g.HeightCM, g.UnitPref, g.Notes, g.ID, g.Version,
	))
	if errors.Is(err, sql.ErrNoRows) {
		// No row matched: distinguish "gone" from "stale version".
		current, gerr := d.GetGarden(ctx, g.ID)
		if gerr != nil {
			return nil, gerr // ErrNotFound (or a real error)
		}
		return current, domain.ErrVersionConflict
	}
	if err != nil {
		return nil, fmt.Errorf("store: update garden: %w", err)
	}
	return updated, nil
}

// DeleteGarden removes a garden (and, via ON DELETE CASCADE, its objects/shares).
// Returns domain.ErrNotFound if no row was deleted.
func (d *DB) DeleteGarden(ctx context.Context, id int64) error {
	res, err := d.sql.ExecContext(ctx, `DELETE FROM gardens WHERE id = ?`, id)
	if err != nil {
		return fmt.Errorf("store: delete garden: %w", err)
	}
	n, err := res.RowsAffected()
	if err != nil {
		return fmt.Errorf("store: garden delete rows: %w", err)
	}
	if n == 0 {
		return domain.ErrNotFound
	}
	return nil
}

// GetGardenByPublicToken returns the garden whose public_token matches, or
// domain.ErrNotFound. Possession of the token is the capability, so there is no
// owner/actor check here — the service exposes this only for the unauthenticated
// public-read path. public_token itself is never selected into the row (it stays
// out of gardenColumns), so it can't leak through the returned garden.
func (d *DB) GetGardenByPublicToken(ctx context.Context, token string) (*domain.Garden, error) {
	g, err := scanGarden(d.sql.QueryRowContext(ctx,
		`SELECT `+gardenColumns+` FROM gardens WHERE public_token = ?`, token))
	if errors.Is(err, sql.ErrNoRows) {
		return nil, domain.ErrNotFound
	}
	if err != nil {
		return nil, fmt.Errorf("store: get garden by public token: %w", err)
	}
	return g, nil
}

// GetGardenPublicToken returns the garden's current public token (nil when the
// public link is disabled), or domain.ErrNotFound if the garden is gone.
func (d *DB) GetGardenPublicToken(ctx context.Context, gardenID int64) (*string, error) {
	var tok sql.NullString
	err := d.sql.QueryRowContext(ctx, `SELECT public_token FROM gardens WHERE id = ?`, gardenID).Scan(&tok)
	if errors.Is(err, sql.ErrNoRows) {
		return nil, domain.ErrNotFound
	}
	if err != nil {
		return nil, fmt.Errorf("store: get garden public token: %w", err)
	}
	if !tok.Valid {
		return nil, nil
	}
	return &tok.String, nil
}

// SetGardenPublicToken sets the garden's public token (enabling/rotating the
// link) or clears it with a nil token (disabling the link). It does not bump the
// garden version — the public link is out-of-band from garden edits, so toggling
// it must not spuriously conflict a concurrent editor. Returns domain.ErrNotFound
// if the garden is gone.
func (d *DB) SetGardenPublicToken(ctx context.Context, gardenID int64, token *string) error {
	var val any
	if token != nil {
		val = *token
	}
	res, err := d.sql.ExecContext(ctx,
		`UPDATE gardens SET public_token = ?, updated_at = strftime('%Y-%m-%dT%H:%M:%SZ', 'now') WHERE id = ?`,
		val, gardenID)
	if err != nil {
		return fmt.Errorf("store: set garden public token: %w", err)
	}
	n, err := res.RowsAffected()
	if err != nil {
		return fmt.Errorf("store: set garden public token rows: %w", err)
	}
	if n == 0 {
		return domain.ErrNotFound
	}
	return nil
}