store: users saved in one transaction, the last global kept inside it (audit M7, M9)

M7: DeleteUser counted the global users and then deleted; the handler's demotion and CreateGlobalUser checked and then wrote. MaxOpenConns(1) serialises statements, not pairs: two globals deleting or demoting each other at once could leave none. Now: - DeleteUser: a transaction that deletes first (taking the write lock) and then requires a global left (requireAGlobal) - ErrLastGlobal rolls back. - SaveUser: likewise for a demotion, the count inside the transaction after the write. The handler's early count stays only to answer before hashing a password; SaveUser decides, and ErrLastGlobal maps to the same message. - CreateGlobalUser: INSERT ... SELECT ... WHERE NOT EXISTS (SELECT 1 FROM users), one statement. M9: submitUserUpdate made five writes in a row (UpdateUser, sessions, SetUserRole, ClearUserReach with its error only logged, SetUserReach). store.SaveUser(UserChange) writes name, hash, e-mail, role and reach in one transaction (a global user's reach cleared); sessions end after it commits. The create path had the same flaw - user, reach and then e-mail in three writes - and now goes through AddUser, one transaction; CreateUser stays as a wrapper for its many test callers. SetUserRole is gone; writeUserReach is the reach write inside a transaction. Tests: store - two globals demoting, and deleting, each other from two goroutines: exactly one refused, one global left; a refused SaveUser (taken name, a reach to no domain, nothing assigned) changes nothing; promoted to global loses the reach; AddUser with a bad reach leaves no user; four setups at once create one user. Handlers (the users pages, direct): the whole change saved, back to domain with a reach; the last global not demoted and the typed rename not written; a domain user with nothing assigned refused, nothing changed; create with e-mail and reach. CHANGELOG [Unreleased], audit plan lines ticked (two), roadmap 17/62. Evidence: go vet ./... clean; go test ./internal/store ok; the users tests of ./internal/web/handlers ok; the server run follows before the push. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-14 15:25:41 +03:00
parent 60c7b85f84
commit f9e75de8d1
7 changed files with 420 additions and 106 deletions
@@ -0,0 +1,151 @@
+package store
+
+import (
+	"errors"
+	"sync"
+	"testing"
+)
+
+// Two global administrators who demote, or delete, each other at the same
+// moment: one of them must stay global. The count is taken inside the
+// transaction that writes, so the second sees the first's change (audit
+// 2026-10-12, M7).
+func TestTheLastGlobalSurvivesTwoAtOnce(t *testing.T) {
+	for _, how := range []string{"demote", "delete"} {
+		t.Run(how, func(t *testing.T) {
+			st := openTestStore(t)
+			d := addTestDomain(t, st, "example.com")
+			var ids []int64
+			for _, name := range []string{"ann", "bob"} {
+				id, err := st.CreateUser(name, "hash", RoleGlobal, Reach{})
+				if err != nil {
+					t.Fatal(err)
+				}
+				ids = append(ids, id)
+			}
+			var wg sync.WaitGroup
+			errs := make([]error, len(ids))
+			for i, id := range ids {
+				wg.Add(1)
+				go func(i int, id int64) {
+					defer wg.Done()
+					if how == "delete" {
+						errs[i] = st.DeleteUser(id)
+						return
+					}
+					errs[i] = st.SaveUser(UserChange{ID: id, Username: []string{"ann", "bob"}[i], PasswordHash: "hash",
+						Role: RoleDomain, Reach: Reach{DomainIDs: []int64{d.ID}}})
+				}(i, id)
+			}
+			wg.Wait()
+			refused := 0
+			for _, err := range errs {
+				switch {
+				case errors.Is(err, ErrLastGlobal):
+					refused++
+				case err != nil:
+					t.Fatalf("unexpected error: %v", err)
+				}
+			}
+			n, err := st.CountGlobalUsers()
+			if err != nil {
+				t.Fatal(err)
+			}
+			if refused != 1 || n != 1 {
+				t.Fatalf("%d refused, %d global users left; want 1 and 1", refused, n)
+			}
+		})
+	}
+}
+
+// SaveUser writes all of a change or none of it.
+func TestSaveUserIsOneChange(t *testing.T) {
+	st := openTestStore(t)
+	d := addTestDomain(t, st, "example.com")
+	if _, err := st.CreateUser("root", "hash", RoleGlobal, Reach{}); err != nil {
+		t.Fatal(err)
+	}
+	id, err := st.CreateUser("shop", "hash", RoleDomain, Reach{DomainIDs: []int64{d.ID}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.CreateUser("taken", "hash", RoleGlobal, Reach{}); err != nil {
+		t.Fatal(err)
+	}
+
+	// A taken name: nothing else of the change is written either.
+	err = st.SaveUser(UserChange{ID: id, Username: "taken", PasswordHash: "new", Email: "x@example.com", Role: RoleGlobal})
+	if !errors.Is(err, ErrUserExists) {
+		t.Fatalf("SaveUser with a taken name = %v", err)
+	}
+	// A reach naming a domain that does not exist fails at the last write.
+	err = st.SaveUser(UserChange{ID: id, Username: "renamed", PasswordHash: "new", Role: RoleDomain, Reach: Reach{DomainIDs: []int64{9999}}})
+	if err == nil {
+		t.Fatal("SaveUser with a reach to no domain succeeded")
+	}
+	if err := st.SaveUser(UserChange{ID: id, Username: "renamed", PasswordHash: "new", Role: RoleDomain}); !errors.Is(err, ErrEmptyReach) {
+		t.Fatalf("SaveUser of a domain user with nothing assigned = %v", err)
+	}
+	u, err := st.GetUser(id)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if u.Username != "shop" || u.PasswordHash != "hash" || u.Email != "" || u.Role != RoleDomain || len(u.DomainIDs) != 1 {
+		t.Fatalf("a refused change left %+v", u)
+	}
+
+	// Made global, the user loses the reach.
+	if err := st.SaveUser(UserChange{ID: id, Username: "shop", PasswordHash: "hash", Email: "s@example.com", Role: RoleGlobal, Reach: Reach{DomainIDs: []int64{d.ID}}}); err != nil {
+		t.Fatal(err)
+	}
+	u, _ = st.GetUser(id)
+	if u.Role != RoleGlobal || u.Email != "s@example.com" || !u.Reach().Empty() {
+		t.Fatalf("promoted: %+v", u)
+	}
+}
+
+// AddUser writes the user, the e-mail and the reach at once; a reach that
+// cannot be written leaves no user behind.
+func TestAddUserIsOneChange(t *testing.T) {
+	st := openTestStore(t)
+	d := addTestDomain(t, st, "example.com")
+	id, err := st.AddUser(UserChange{Username: "shop", PasswordHash: "hash", Email: "s@example.com", Role: RoleDomain, Reach: Reach{DomainIDs: []int64{d.ID}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	u, _ := st.GetUser(id)
+	if u.Email != "s@example.com" || len(u.DomainIDs) != 1 {
+		t.Fatalf("created %+v", u)
+	}
+	if _, err := st.AddUser(UserChange{Username: "ghost", PasswordHash: "hash", Role: RoleDomain, Reach: Reach{DomainIDs: []int64{9999}}}); err == nil {
+		t.Fatal("AddUser with a reach to no domain succeeded")
+	}
+	if _, err := st.GetUserByUsername("ghost"); !errors.Is(err, ErrUserNotFound) {
+		t.Fatalf("the failed create left a user: %v", err)
+	}
+}
+
+// Setup creates the first user once, however many requests race for it.
+func TestCreateGlobalUserOnlyOnce(t *testing.T) {
+	st := openTestStore(t)
+	var wg sync.WaitGroup
+	errs := make([]error, 4)
+	for i := range errs {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			errs[i] = st.CreateGlobalUser([]string{"a", "b", "c", "d"}[i], "hash")
+		}(i)
+	}
+	wg.Wait()
+	ok := 0
+	for _, err := range errs {
+		if err == nil {
+			ok++
+		}
+	}
+	n, _ := st.CountGlobalUsers()
+	if ok != 1 || n != 1 {
+		t.Fatalf("%d setups succeeded, %d global users; want 1 and 1", ok, n)
+	}
+}