adminprovision

type ProvisionInput ¶

type ProvisionInput struct {
	TenantID     tenant.TenantID
	Username     string
	Email        string
	PasswordHash []byte
	RequireReset bool
}

ProvisionInput holds the inputs for a single Ensure call.

PasswordHash is pre-hashed by the caller (bcrypt). Provisioner never sees plaintext. A duplicate username returns 409 ErrAuthUserDuplicate; the caller must use a unique username (setup path enforces this at HTTP layer). TenantID identifies the tenant for which the admin is being provisioned.

type ProvisionOutcome ¶

type ProvisionOutcome int

ProvisionOutcome is the result classification returned from Ensure.

Callers decide per outcome whether to persist side effects (credfile, event) or surface 409 / silently skip.

const (
	// OutcomeUnknown is the zero value; it is never returned successfully.
	OutcomeUnknown ProvisionOutcome = iota
	// OutcomeCreated means a fresh admin user + role assignment were persisted.
	// Caller may emit user.created event and/or write credential file.
	OutcomeCreated
	// OutcomeAlreadyExists means at least one admin existed at the fast-path
	// CountByRole check; no side effects were performed. Caller returns 409
	// (HTTP) or nil (Lifecycle — silent skip).
	OutcomeAlreadyExists
	// OutcomeRaceSkipped means the fast-path CountByRole read zero admins but
	// a concurrent replica persisted the admin between check and create.
	// No rows were written. Caller treats the same as OutcomeAlreadyExists.
	OutcomeRaceSkipped
)

type ProvisionResult ¶

type ProvisionResult struct {
	User    *domain.User
	Outcome ProvisionOutcome
}

ProvisionResult holds the successful outcome of Ensure.

type Provisioner ¶

type Provisioner struct {
	// contains filtered or unexported fields
}

Provisioner is the shared domain service.

It is caller-tx-neutral: Ensure does not open a transaction; callers wrap it with their own TxRunner if atomicity across Ensure + adjacent writes is required.

Concurrency: Ensure is NOT internally serialized. Callers must serialize concurrent invocations through a transactional boundary that locks the CountByRole-Create-Assign window:

• PG mode: open a transaction via persistence.TxRunner.RunInTx and call ports.SetupLockAcquirer.Acquire inside it. The PG implementation (PGSetupLock) uses pg_advisory_xact_lock, which is exclusive across pods and goroutines until tx commit/rollback.
• Memstore mode: use Store.TxRunner — memTxRunner.RunInTx holds store.mu for the entire closure, serializing all goroutines (equivalent to PG SELECT FOR UPDATE held until commit).

The single production caller (cells/accesscore/slices/setup.Service.CreateAdmin) wires both via RunInTx + the mandatory accesscore.WithSetupLock option. PG composition roots inject accesspg.NewBundle(pool, txm, clk).SetupLock(); memstore callers inject accesscore.NoopSetupLock{} (no second lock — store.mu does the work).

func NewProvisioner(
	userRepo ports.UserRepository, roleRepo ports.RoleRepository, logger *slog.Logger, newID UUIDGenerator, clk clock.Clock,
) (*Provisioner, error)

func (p *Provisioner) Compensate(ctx context.Context, t tenant.TenantID, userID string)

func (p *Provisioner) Ensure(ctx context.Context, in ProvisionInput) (ProvisionResult, error)

func (p *Provisioner) Status(ctx context.Context, t tenant.TenantID) (bool, error)

type UUIDGenerator ¶

type UUIDGenerator func() string

UUIDGenerator returns a fresh UUID string. Injected for deterministic tests.