Files
pansy/internal/store/gardens.go
T
steveandClaude Opus 4.8 a615de633f
Build image / build-and-push (push) Successful in 5s
Gadfly review (reusable) / review (pull_request) Successful in 10m11s
Adversarial Review (Gadfly) / review (pull_request) Successful in 10m11s
Add sharing backend: shares CRUD + ACL enforcement everywhere (#16)
- domain: Garden gains a computed MyRole ("owner"/"editor"/"viewer"); new
  ShareWithUser (share + recipient identity); sentinels ErrShareUserNotFound,
  ErrCannotShareWithSelf, ErrShareExists.
- store/shares.go: GetShareRole, ListSharesForGarden (joined with users),
  CreateShare (UNIQUE → ErrShareExists), UpdateShareRole, DeleteShare.
- store/gardens.go: ListGardensForActor returns owned + shared-with-me gardens,
  each carrying my_role (replaces the owner-only list).
- service: requireGardenRole now consults garden_shares (owner implicit, else the
  share's role, else masked ErrNotFound) and stamps MyRole on every read-through.
  UpdateGarden tightened to OWNER-only (editors edit contents, not the garden).
  UpdatePlanting only re-checks plant visibility when the plant is CHANGED, so a
  shared editor can edit a plop that uses the owner's private plant.
- service/shares.go: ListShares/AddShare/UpdateShareRole (owner only), RemoveShare
  (owner or a recipient leaving). AddShare targets an existing account by exact
  email; unknown → 404, self → 400, duplicate → 409.
- api: GET,POST /gardens/:id/shares and PATCH,DELETE /gardens/:id/shares/:userId.

Tests: the full {owner, editor, viewer, stranger} × {read, mutate object, mutate
planting, edit garden, delete garden, manage shares} ACL matrix; shared gardens
carry my_role; AddShare error cases; role upgrade + self-leave; plus a two-user
HTTP flow. The matrix caught the editor-cannot-edit-owner's-plant bug above.

GOWORK=off go build/vet/test ./internal/... green.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi
2026-07-18 23:32:35 -04:00

156 lines
5.2 KiB
Go

package store
import (
"context"
"database/sql"
"errors"
"fmt"
"gitea.stevedudenhoeffer.com/steve/pansy/internal/domain"
)
// gardenColumns lists the gardens columns in the fixed order scanGarden expects.
const gardenColumns = `id, owner_id, name, width_cm, height_cm, unit_pref, notes, version, created_at, updated_at`
func scanGarden(s scanner) (*domain.Garden, error) {
var g domain.Garden
if err := s.Scan(
&g.ID, &g.OwnerID, &g.Name, &g.WidthCM, &g.HeightCM,
&g.UnitPref, &g.Notes, &g.Version, &g.CreatedAt, &g.UpdatedAt,
); err != nil {
return nil, err
}
return &g, nil
}
// scanGardenWithRole reads a garden row plus a trailing my_role column into the
// computed Garden.MyRole field (used by the actor-scoped list).
func scanGardenWithRole(s scanner) (*domain.Garden, error) {
var g domain.Garden
if err := s.Scan(
&g.ID, &g.OwnerID, &g.Name, &g.WidthCM, &g.HeightCM,
&g.UnitPref, &g.Notes, &g.Version, &g.CreatedAt, &g.UpdatedAt, &g.MyRole,
); err != nil {
return nil, err
}
return &g, nil
}
// maxGardensListed caps the gardens list as a defensive backstop against a
// pathologically large result. At household scale a user has a handful of
// gardens, so this is never hit; genuine pagination is post-v1 if ever needed.
const maxGardensListed = 1000
// CreateGarden inserts a garden (owner_id, name, dimensions, unit, notes already
// set and validated by the service) and returns the stored row.
func (d *DB) CreateGarden(ctx context.Context, g *domain.Garden) (*domain.Garden, error) {
created, err := scanGarden(d.sql.QueryRowContext(ctx,
`INSERT INTO gardens (owner_id, name, width_cm, height_cm, unit_pref, notes)
VALUES (?, ?, ?, ?, ?, ?)
RETURNING `+gardenColumns,
g.OwnerID, g.Name, g.WidthCM, g.HeightCM, g.UnitPref, g.Notes,
))
if err != nil {
return nil, fmt.Errorf("store: insert garden: %w", err)
}
return created, nil
}
// GetGarden returns the garden with the given id, or domain.ErrNotFound.
func (d *DB) GetGarden(ctx context.Context, id int64) (*domain.Garden, error) {
g, err := scanGarden(d.sql.QueryRowContext(ctx,
`SELECT `+gardenColumns+` FROM gardens WHERE id = ?`, id))
if errors.Is(err, sql.ErrNoRows) {
return nil, domain.ErrNotFound
}
if err != nil {
return nil, fmt.Errorf("store: get garden: %w", err)
}
return g, nil
}
// ListGardensForActor returns the gardens an actor can see — those they own
// (my_role "owner") plus those shared with them (my_role = the share's role) —
// newest first. Always a non-nil slice.
func (d *DB) ListGardensForActor(ctx context.Context, actorID int64) ([]domain.Garden, error) {
rows, err := d.sql.QueryContext(ctx,
`SELECT `+gardenColumns+`, my_role FROM (
SELECT `+gardenColumns+`, 'owner' AS my_role FROM gardens WHERE owner_id = ?
UNION ALL
SELECT `+qualifyColumns("g", gardenColumns)+`, s.role AS my_role
FROM gardens g JOIN garden_shares s ON s.garden_id = g.id
WHERE s.user_id = ?
)
ORDER BY created_at DESC, id DESC
LIMIT ?`,
actorID, actorID, maxGardensListed,
)
if err != nil {
return nil, fmt.Errorf("store: list gardens: %w", err)
}
defer rows.Close()
gardens := []domain.Garden{}
for rows.Next() {
g, err := scanGardenWithRole(rows)
if err != nil {
return nil, fmt.Errorf("store: scan garden: %w", err)
}
gardens = append(gardens, *g)
}
if err := rows.Err(); err != nil {
return nil, fmt.Errorf("store: iterate gardens: %w", err)
}
return gardens, nil
}
// UpdateGarden applies a version-guarded update (optimistic concurrency): the row
// is written only if its stored version matches g.Version, and version is
// incremented on success. It returns:
// - the updated row, on success;
// - (current row, domain.ErrVersionConflict) when the version didn't match, so
// the caller can hand the fresh row back to the client to rebase;
// - (nil, domain.ErrNotFound) if the row no longer exists.
//
// This is the sync contract every mutable resource in pansy follows.
func (d *DB) UpdateGarden(ctx context.Context, g *domain.Garden) (*domain.Garden, error) {
updated, err := scanGarden(d.sql.QueryRowContext(ctx,
`UPDATE gardens
SET name = ?, width_cm = ?, height_cm = ?, unit_pref = ?, notes = ?,
version = version + 1,
updated_at = strftime('%Y-%m-%dT%H:%M:%SZ', 'now')
WHERE id = ? AND version = ?
RETURNING `+gardenColumns,
g.Name, g.WidthCM, g.HeightCM, g.UnitPref, g.Notes, g.ID, g.Version,
))
if errors.Is(err, sql.ErrNoRows) {
// No row matched: distinguish "gone" from "stale version".
current, gerr := d.GetGarden(ctx, g.ID)
if gerr != nil {
return nil, gerr // ErrNotFound (or a real error)
}
return current, domain.ErrVersionConflict
}
if err != nil {
return nil, fmt.Errorf("store: update garden: %w", err)
}
return updated, nil
}
// DeleteGarden removes a garden (and, via ON DELETE CASCADE, its objects/shares).
// Returns domain.ErrNotFound if no row was deleted.
func (d *DB) DeleteGarden(ctx context.Context, id int64) error {
res, err := d.sql.ExecContext(ctx, `DELETE FROM gardens WHERE id = ?`, id)
if err != nil {
return fmt.Errorf("store: delete garden: %w", err)
}
n, err := res.RowsAffected()
if err != nil {
return fmt.Errorf("store: garden delete rows: %w", err)
}
if n == 0 {
return domain.ErrNotFound
}
return nil
}