refactor: remove Dex local-password invite provisioning (ADR-019)
Authentik owns invites now (infra ADR-0001). Delete adapters/dex, the /invite set-password UI, the tapir invite CLI, the InvitationStore/ DexPasswordCreator ports + App wiring, the invite Templ pages, and the invite Taskfile target. New users are invited via Authentik, log in via OIDC, and hit the existing /register gate. invitations table (mig 009) left in place (append-only; harmless). task check green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Claude Opus 4.8
@@ -1,86 +0,0 @@
|
||||
package store
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/rand"
|
||||
"encoding/hex"
|
||||
"errors"
|
||||
"fmt"
|
||||
"time"
|
||||
|
||||
"github.com/jackc/pgx/v5"
|
||||
)
|
||||
|
||||
// Invitations are NOT routed through withUser: an invitation exists before its
|
||||
// user does, so there is no user_id to scope by and no authenticated context when
|
||||
// one is minted (host CLI) or claimed (the public /invite handler). The token is
|
||||
// the capability — single-use, time-boxed, crypto-random. The invitations table
|
||||
// is deliberately outside RLS for the same reason (see migration 009).
|
||||
|
||||
// CreateInvitation mints a single-use invite for email, valid for ttl, and
|
||||
// returns its token. The token is 32 bytes of crypto-random entropy, hex-encoded;
|
||||
// it is the only secret a recipient needs to claim the invite.
|
||||
func (s *Store) CreateInvitation(ctx context.Context, email string, ttl time.Duration) (string, error) {
|
||||
token, err := newInviteToken()
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
if _, err := s.pool.Exec(ctx,
|
||||
`INSERT INTO invitations (email, token, expires_at)
|
||||
VALUES ($1, $2, NOW() + $3::interval)`,
|
||||
email, token, ttl.String()); err != nil {
|
||||
return "", fmt.Errorf("store: create invitation: %w", err)
|
||||
}
|
||||
return token, nil
|
||||
}
|
||||
|
||||
// PeekInvitation returns the invited email for a token that is real, unexpired,
|
||||
// and unused WITHOUT consuming it — the read the /invite form does to validate the
|
||||
// link before showing the password fields. Returns ErrNotFound when the token is
|
||||
// missing, expired, or already used. Use ClaimInvitation to consume.
|
||||
func (s *Store) PeekInvitation(ctx context.Context, token string) (string, error) {
|
||||
var email string
|
||||
err := s.pool.QueryRow(ctx,
|
||||
`SELECT email FROM invitations
|
||||
WHERE token = $1 AND used_at IS NULL AND expires_at > NOW()`,
|
||||
token).Scan(&email)
|
||||
if errors.Is(err, pgx.ErrNoRows) {
|
||||
return "", ErrNotFound
|
||||
}
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("store: peek invitation: %w", err)
|
||||
}
|
||||
return email, nil
|
||||
}
|
||||
|
||||
// ClaimInvitation atomically consumes a valid invite and returns its email. The
|
||||
// UPDATE ... WHERE used_at IS NULL AND expires_at > NOW() guarded by RETURNING
|
||||
// makes the claim a single round-trip race-free check-and-set: two concurrent
|
||||
// claims of the same token, only one updates a row, the other gets no rows and so
|
||||
// ErrNotFound. Same ErrNotFound for missing/expired/already-used tokens.
|
||||
func (s *Store) ClaimInvitation(ctx context.Context, token string) (string, error) {
|
||||
var email string
|
||||
err := s.pool.QueryRow(ctx,
|
||||
`UPDATE invitations
|
||||
SET used_at = NOW()
|
||||
WHERE token = $1 AND used_at IS NULL AND expires_at > NOW()
|
||||
RETURNING email`,
|
||||
token).Scan(&email)
|
||||
if errors.Is(err, pgx.ErrNoRows) {
|
||||
return "", ErrNotFound
|
||||
}
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("store: claim invitation: %w", err)
|
||||
}
|
||||
return email, nil
|
||||
}
|
||||
|
||||
// newInviteToken returns 32 bytes of crypto-random entropy, hex-encoded (64
|
||||
// chars). Hex keeps the token URL-safe with no escaping in /invite/{token}.
|
||||
func newInviteToken() (string, error) {
|
||||
var b [32]byte
|
||||
if _, err := rand.Read(b[:]); err != nil {
|
||||
return "", fmt.Errorf("store: invite token: %w", err)
|
||||
}
|
||||
return hex.EncodeToString(b[:]), nil
|
||||
}
|
||||
@@ -1,110 +0,0 @@
|
||||
package store_test
|
||||
|
||||
import (
|
||||
"context"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"gitea.d-ma.be/mathias/tapir/internal/adapters/store"
|
||||
)
|
||||
|
||||
// resetInvitations clears the invitations table between cases. It is not in the
|
||||
// shared resetDB TRUNCATE list (invitations is not user-owned and has no FK to
|
||||
// users), so the invite tests wipe it themselves.
|
||||
func resetInvitations(t *testing.T, p *pgxpool.Pool) {
|
||||
t.Helper()
|
||||
_, err := p.Exec(context.Background(), `TRUNCATE invitations`)
|
||||
require.NoError(t, err)
|
||||
}
|
||||
|
||||
func TestCreateInvitationReturnsUsableToken(t *testing.T) {
|
||||
s, p := newStore(t), rawPool(t)
|
||||
resetInvitations(t, p)
|
||||
ctx := context.Background()
|
||||
|
||||
token, err := s.CreateInvitation(ctx, "new@example.com", time.Hour)
|
||||
require.NoError(t, err)
|
||||
require.Len(t, token, 64, "32 random bytes hex-encoded")
|
||||
|
||||
// Peek does not consume: the same token previews twice.
|
||||
email, err := s.PeekInvitation(ctx, token)
|
||||
require.NoError(t, err)
|
||||
require.Equal(t, "new@example.com", email)
|
||||
email, err = s.PeekInvitation(ctx, token)
|
||||
require.NoError(t, err)
|
||||
require.Equal(t, "new@example.com", email)
|
||||
}
|
||||
|
||||
func TestCreateInvitationTokensAreUnique(t *testing.T) {
|
||||
s, p := newStore(t), rawPool(t)
|
||||
resetInvitations(t, p)
|
||||
ctx := context.Background()
|
||||
|
||||
t1, err := s.CreateInvitation(ctx, "a@example.com", time.Hour)
|
||||
require.NoError(t, err)
|
||||
t2, err := s.CreateInvitation(ctx, "b@example.com", time.Hour)
|
||||
require.NoError(t, err)
|
||||
require.NotEqual(t, t1, t2)
|
||||
}
|
||||
|
||||
func TestClaimInvitationHappyPath(t *testing.T) {
|
||||
s, p := newStore(t), rawPool(t)
|
||||
resetInvitations(t, p)
|
||||
ctx := context.Background()
|
||||
|
||||
token, err := s.CreateInvitation(ctx, "claim@example.com", time.Hour)
|
||||
require.NoError(t, err)
|
||||
|
||||
email, err := s.ClaimInvitation(ctx, token)
|
||||
require.NoError(t, err)
|
||||
require.Equal(t, "claim@example.com", email)
|
||||
}
|
||||
|
||||
func TestClaimInvitationIsSingleUse(t *testing.T) {
|
||||
s, p := newStore(t), rawPool(t)
|
||||
resetInvitations(t, p)
|
||||
ctx := context.Background()
|
||||
|
||||
token, err := s.CreateInvitation(ctx, "once@example.com", time.Hour)
|
||||
require.NoError(t, err)
|
||||
|
||||
_, err = s.ClaimInvitation(ctx, token)
|
||||
require.NoError(t, err)
|
||||
|
||||
// Second claim fails — already used.
|
||||
_, err = s.ClaimInvitation(ctx, token)
|
||||
require.ErrorIs(t, err, store.ErrNotFound)
|
||||
|
||||
// And a used token no longer previews.
|
||||
_, err = s.PeekInvitation(ctx, token)
|
||||
require.ErrorIs(t, err, store.ErrNotFound)
|
||||
}
|
||||
|
||||
func TestClaimInvitationExpired(t *testing.T) {
|
||||
s, p := newStore(t), rawPool(t)
|
||||
resetInvitations(t, p)
|
||||
ctx := context.Background()
|
||||
|
||||
// Negative ttl => already expired.
|
||||
token, err := s.CreateInvitation(ctx, "old@example.com", -time.Minute)
|
||||
require.NoError(t, err)
|
||||
|
||||
_, err = s.PeekInvitation(ctx, token)
|
||||
require.ErrorIs(t, err, store.ErrNotFound)
|
||||
_, err = s.ClaimInvitation(ctx, token)
|
||||
require.ErrorIs(t, err, store.ErrNotFound)
|
||||
}
|
||||
|
||||
func TestClaimInvitationNotFound(t *testing.T) {
|
||||
s, p := newStore(t), rawPool(t)
|
||||
resetInvitations(t, p)
|
||||
ctx := context.Background()
|
||||
|
||||
_, err := s.ClaimInvitation(ctx, "does-not-exist")
|
||||
require.ErrorIs(t, err, store.ErrNotFound)
|
||||
_, err = s.PeekInvitation(ctx, "does-not-exist")
|
||||
require.ErrorIs(t, err, store.ErrNotFound)
|
||||
}
|
||||
Reference in New Issue
Block a user