Absorb the roles bricks and ask capabilities

Makefile

@@ -144,7 +144,7 @@ e2e-db-reset: db-up
 e2e-seed: db-up e2e-build
 	printf '%s\n' "$(E2E_PASSWORD)" | \
 		ALPHONE_DATABASE_URL="$(E2E_DATABASE_URL)" ./alphone createadmin \
-		-email "$(E2E_EMAIL)" -name "$(E2E_NAME)"
+		-email "$(E2E_EMAIL)" -name "$(E2E_NAME)" -role admin
 
 e2e-reset: e2e-db-reset e2e-seed
 

cmd/alphone/createadmin.go

@@ -8,14 +8,12 @@ import (
 	"flag"
 	"fmt"
 	"io"
-	"strings"
 
 	"github.com/jackc/pgx/v5/pgxpool"
 
 	"github.com/gopherium/gouncer/authkit"
 	authkitpg "github.com/gopherium/gouncer/authkit/postgres"
 
-	"github.com/gopherium/alphone/internal/postgres"
 	"github.com/gopherium/alphone/internal/role"
 )
 
@@ -32,6 +30,7 @@ func createAdmin(
 	flags.SetOutput(stdout)
 	email := flags.String("email", "", "email address of the new user")
 	name := flags.String("name", "", "display name of the new user")
+	named := flags.String("role", "", "role the new user starts under")
 	if err := flags.Parse(args); err != nil {
 		if errors.Is(err, flag.ErrHelp) {
 			return nil
@@ -43,6 +42,10 @@ func createAdmin(
 	if databaseURL == "" {
 		return errors.New("ALPHONE_DATABASE_URL is required")
 	}
+	held, err := role.Parse(*named)
+	if err != nil {
+		return err
+	}
 	pool, err := pgxpool.New(ctx, databaseURL)
 	if err != nil {
 		return fmt.Errorf("parse database url: %w", err)
@@ -53,17 +56,5 @@ func createAdmin(
 	}
 
 	users := authkitpg.NewUserStore(pool)
-	if err := authkit.CreateAdmin(ctx, users, *email, *name, stdin, stdout); err != nil {
-		return err
-	}
-	return grantAdmin(ctx, pool, users, *email)
-}
-
-// grantAdmin puts the named user in the admin tier.
-func grantAdmin(ctx context.Context, pool *pgxpool.Pool, users *authkitpg.UserStore, email string) error {
-	owner, err := users.UserByEmail(ctx, strings.ToLower(strings.TrimSpace(email)))
-	if err != nil {
-		return err
-	}
-	return postgres.NewRoleStore(pool).Grant(ctx, owner.ID, role.Admin)
+	return authkit.CreateAdmin(ctx, users, *email, *name, held.String(), stdin, stdout)
 }

cmd/alphone/createadmin_test.go

@@ -12,6 +12,8 @@ import (
 
 	"github.com/gopherium/gouncer"
 	authkitpg "github.com/gopherium/gouncer/authkit/postgres"
+
+	"github.com/gopherium/alphone/internal/role"
 )
 
 const unreachableDatabaseURL = "postgres://postgres:alphone@localhost:9/postgres?sslmode=disable&connect_timeout=1"
@@ -26,7 +28,7 @@ func TestCreateAdminProvisionsAUser(t *testing.T) {
 	err := createAdmin(
 		t.Context(),
 		getenv,
-		[]string{"-email", " Admin@Example.com ", "-name", "Admin"},
+		[]string{"-email", " Admin@Example.com ", "-name", "Admin", "-role", "admin"},
 		strings.NewReader("correct horse battery\n"),
 		&stdout,
 	)
@@ -57,7 +59,7 @@ func TestCreateAdminRejectsDuplicateEmail(t *testing.T) {
 
 	databaseURL := testDatabaseURL(t)
 	getenv := testGetenv(map[string]string{"ALPHONE_DATABASE_URL": databaseURL})
-	args := []string{"-email", "admin@example.com", "-name", "Admin"}
+	args := []string{"-email", "admin@example.com", "-name", "Admin", "-role", "admin"}
 
 	if err := createAdmin(
 		t.Context(), getenv, args, strings.NewReader("correct horse battery\n"), io.Discard,
@@ -84,7 +86,7 @@ func TestCreateAdminValidatesItsInput(t *testing.T) {
 	}{
 		"missing database url": {
 			env:   nil,
-			args:  []string{"-email", "admin@example.com", "-name", "Admin"},
+			args:  []string{"-email", "admin@example.com", "-name", "Admin", "-role", "admin"},
 			stdin: strings.NewReader("correct horse battery\n"),
 		},
 		"unknown flag": {
@@ -94,12 +96,12 @@ func TestCreateAdminValidatesItsInput(t *testing.T) {
 		},
 		"malformed database url": {
 			env:   map[string]string{"ALPHONE_DATABASE_URL": "not a url \x00"},
-			args:  []string{"-email", "admin@example.com", "-name", "Admin"},
+			args:  []string{"-email", "admin@example.com", "-name", "Admin", "-role", "admin"},
 			stdin: strings.NewReader("correct horse battery\n"),
 		},
 		"unreachable database": {
 			env:   map[string]string{"ALPHONE_DATABASE_URL": unreachableDatabaseURL},
-			args:  []string{"-email", "admin@example.com", "-name", "Admin"},
+			args:  []string{"-email", "admin@example.com", "-name", "Admin", "-role", "admin"},
 			stdin: strings.NewReader("correct horse battery\n"),
 		},
 	}
@@ -117,6 +119,36 @@ func TestCreateAdminValidatesItsInput(t *testing.T) {
 	}
 }
 
+func TestCreateAdminRefusesARoleTheRegistryDoesNotKnow(t *testing.T) {
+	t.Parallel()
+
+	getenv := testGetenv(map[string]string{"ALPHONE_DATABASE_URL": testDatabaseURL(t)})
+
+	err := createAdmin(
+		t.Context(),
+		getenv,
+		[]string{"-email", "admin@example.com", "-name", "Admin", "-role", "superadmin"},
+		strings.NewReader("correct horse battery\n"),
+		io.Discard,
+	)
+
+	if !errors.Is(err, role.ErrUnknownTier) {
+		t.Errorf("createAdmin() error = %v, want a role no plugin declared refused", err)
+	}
+}
+
+func TestCreateAdminNamesTheMissingDatabaseBeforeTheRole(t *testing.T) {
+	t.Parallel()
+
+	err := createAdmin(
+		t.Context(), testGetenv(nil), nil, strings.NewReader(""), io.Discard,
+	)
+
+	if err == nil || errors.Is(err, role.ErrUnknownTier) {
+		t.Errorf("createAdmin() error = %v, want the database url named first", err)
+	}
+}
+
 func TestCreateAdminPrintsItsFlags(t *testing.T) {
 	t.Parallel()
 

cmd/alphone/grantrole.go

@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: Elastic-2.0
+
+package main
+
+import (
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+
+	authkitpg "github.com/gopherium/gouncer/authkit/postgres"
+
+	"github.com/gopherium/alphone/internal/role"
+)
+
+// grantRole gives a role to every account holding none, from command-line arguments.
+func grantRole(ctx context.Context, getenv func(string) string, args []string, stdout io.Writer) error {
+	flags := flag.NewFlagSet("grantrole", flag.ContinueOnError)
+	flags.SetOutput(stdout)
+	named := flags.String("role", "", "role to give every account holding none")
+	if err := flags.Parse(args); err != nil {
+		if errors.Is(err, flag.ErrHelp) {
+			return nil
+		}
+		return fmt.Errorf("parse flags: %w", err)
+	}
+
+	databaseURL := getenv("ALPHONE_DATABASE_URL")
+	if databaseURL == "" {
+		return errors.New("ALPHONE_DATABASE_URL is required")
+	}
+	held, err := role.Parse(*named)
+	if err != nil {
+		return err
+	}
+	if err := migrateSchemas(ctx, databaseURL); err != nil {
+		return err
+	}
+	return authkitpg.RunGrantRole(ctx, databaseURL, []string{"-role", held.String()}, stdout)
+}

cmd/alphone/grantrole_exec_test.go

@@ -0,0 +1,43 @@
+// SPDX-License-Identifier: Elastic-2.0
+
+package main
+
+import (
+	"bytes"
+	"os/exec"
+	"strings"
+	"testing"
+
+	authkitpg "github.com/gopherium/gouncer/authkit/postgres"
+
+	"github.com/gopherium/alphone/internal/role"
+)
+
+func TestMainBinaryGrantsARoleToEveryAccountHoldingNone(t *testing.T) {
+	t.Parallel()
+
+	binary, env := coverBinary(t)
+	databaseURL := testDatabaseURL(t)
+	holding := storeRoleless(t, databaseURL, "none@example.com")
+	var stdout bytes.Buffer
+	granting := exec.Command(binary, "grantrole", "-role", "member")
+	granting.Dir = t.TempDir()
+	granting.Env = append(env, "ALPHONE_DATABASE_URL="+databaseURL)
+	granting.Stdout = &stdout
+
+	if err := granting.Run(); err != nil {
+		t.Fatalf("grantrole: %v, answered %s", err, stdout.String())
+	}
+
+	users := authkitpg.NewUserStore(testPool(t, databaseURL))
+	held, err := users.UserByID(t.Context(), holding.ID)
+	if err != nil {
+		t.Fatalf("UserByID() error = %v, want nil", err)
+	}
+	if held.Role != role.Member.String() {
+		t.Errorf("role = %q, want %q written by the running binary", held.Role, role.Member.String())
+	}
+	if !strings.Contains(stdout.String(), "1") {
+		t.Errorf("output = %q, want it to count the account that took the role", stdout.String())
+	}
+}

cmd/alphone/grantrole_test.go

@@ -0,0 +1,135 @@
+// SPDX-License-Identifier: Elastic-2.0
+
+package main
+
+import (
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/gopherium/gouncer"
+	authkitpg "github.com/gopherium/gouncer/authkit/postgres"
+
+	"github.com/gopherium/alphone/internal/role"
+)
+
+// storeRoleless stores one account holding no role and returns it.
+func storeRoleless(t *testing.T, databaseURL, email string) gouncer.User {
+	t.Helper()
+	held, err := gouncer.NewUser(email, "Maria Perez", "correct horse battery")
+	if err != nil {
+		t.Fatalf("gouncer.NewUser() error = %v, want nil", err)
+	}
+	if err := authkitpg.NewUserStore(testPool(t, databaseURL)).CreateUser(t.Context(), held); err != nil {
+		t.Fatalf("CreateUser() error = %v, want nil", err)
+	}
+	return held
+}
+
+func TestGrantRoleReachesEveryAccountHoldingNone(t *testing.T) {
+	t.Parallel()
+
+	databaseURL := testDatabaseURL(t)
+	getenv := testGetenv(map[string]string{"ALPHONE_DATABASE_URL": databaseURL})
+	holding := storeRoleless(t, databaseURL, "none@example.com")
+	var stdout strings.Builder
+
+	if err := grantRole(t.Context(), getenv, []string{"-role", "member"}, &stdout); err != nil {
+		t.Fatalf("grantRole() error = %v, want nil", err)
+	}
+
+	users := authkitpg.NewUserStore(testPool(t, databaseURL))
+	held, err := users.UserByID(t.Context(), holding.ID)
+	if err != nil {
+		t.Fatalf("UserByID() error = %v, want nil", err)
+	}
+	if held.Role != role.Member.String() {
+		t.Errorf("role = %q, want %q", held.Role, role.Member.String())
+	}
+	if !strings.Contains(stdout.String(), "1") {
+		t.Errorf("output = %q, want it to count the account that took the role", stdout.String())
+	}
+}
+
+func TestGrantRoleLeavesAnAccountThatHoldsOne(t *testing.T) {
+	t.Parallel()
+
+	databaseURL := testDatabaseURL(t)
+	getenv := testGetenv(map[string]string{"ALPHONE_DATABASE_URL": databaseURL})
+	standing := storeRoleless(t, databaseURL, "standing@example.com")
+	if err := grantRole(t.Context(), getenv, []string{"-role", "admin"}, &strings.Builder{}); err != nil {
+		t.Fatalf("first grantRole() error = %v, want nil", err)
+	}
+
+	if err := grantRole(t.Context(), getenv, []string{"-role", "member"}, &strings.Builder{}); err != nil {
+		t.Fatalf("second grantRole() error = %v, want nil", err)
+	}
+
+	users := authkitpg.NewUserStore(testPool(t, databaseURL))
+	held, err := users.UserByID(t.Context(), standing.ID)
+	if err != nil {
+		t.Fatalf("UserByID() error = %v, want nil", err)
+	}
+	if held.Role != role.Admin.String() {
+		t.Errorf("role = %q, want %q, a second run leaves an account that holds one", held.Role, role.Admin.String())
+	}
+}
+
+func TestGrantRoleRefusesARoleTheRegistryDoesNotKnow(t *testing.T) {
+	t.Parallel()
+
+	getenv := testGetenv(map[string]string{"ALPHONE_DATABASE_URL": testDatabaseURL(t)})
+
+	err := grantRole(t.Context(), getenv, []string{"-role", "superadmin"}, &strings.Builder{})
+
+	if !errors.Is(err, role.ErrUnknownTier) {
+		t.Errorf("grantRole() error = %v, want a role no plugin declared refused", err)
+	}
+}
+
+func TestGrantRoleNamesTheMissingDatabaseBeforeTheRole(t *testing.T) {
+	t.Parallel()
+
+	err := grantRole(t.Context(), testGetenv(nil), nil, &strings.Builder{})
+
+	if err == nil || errors.Is(err, role.ErrUnknownTier) {
+		t.Errorf("grantRole() error = %v, want the database url named first", err)
+	}
+}
+
+func TestGrantRoleRefusesAFlagItDoesNotKnow(t *testing.T) {
+	t.Parallel()
+
+	err := grantRole(t.Context(), testGetenv(nil), []string{"-bogus"}, &strings.Builder{})
+
+	if err == nil {
+		t.Error("grantRole() error = nil, want the unknown flag refused")
+	}
+}
+
+func TestGrantRoleReportsADatabaseItCannotReach(t *testing.T) {
+	t.Parallel()
+
+	getenv := testGetenv(map[string]string{"ALPHONE_DATABASE_URL": unreachableDatabaseURL})
+
+	err := grantRole(t.Context(), getenv, []string{"-role", "member"}, &strings.Builder{})
+
+	if err == nil {
+		t.Error("grantRole() error = nil, want the unreachable database reported")
+	}
+}
+
+func TestGrantRolePrintsItsFlags(t *testing.T) {
+	t.Parallel()
+
+	var stdout strings.Builder
+
+	err := grantRole(t.Context(), testGetenv(nil), []string{"-h"}, &stdout)
+
+	if err != nil {
+		t.Fatalf("grantRole() error = %v, want nil", err)
+	}
+	if !strings.Contains(stdout.String(), "-role") {
+		t.Errorf("output = %q, want the flags listed", stdout.String())
+	}
+}