ds-galo/backend/internal/members/service.go

package members

import (
	"context"
	"errors"
	"time"

	"shared-album/internal/auth"
	"shared-album/internal/httpx"
	"shared-album/internal/models"
	"shared-album/internal/roles"
	"shared-album/internal/sse"
)

type AlbumReader interface {
	OwnerID(ctx context.Context, albumID string) (string, error)
}

type Notifier interface {
	Create(ctx context.Context, userID, typ string, payload map[string]any) error
}

type Service struct {
	store  Repository
	albums AlbumReader
	hub    *sse.Hub
	notify Notifier
}

func NewService(store Repository, albums AlbumReader, hub *sse.Hub, notify Notifier) *Service {
	return &Service{store: store, albums: albums, hub: hub, notify: notify}
}

func (s *Service) Role(ctx context.Context, albumID, userID string) (string, error) {
	return s.store.Role(ctx, albumID, userID)
}

func (s *Service) actorRole(ctx context.Context, albumID, actorID string) (string, error) {
	ownerID, err := s.albums.OwnerID(ctx, albumID)
	if err != nil {
		return "", err
	}
	if ownerID == actorID {
		return roles.Owner, nil
	}
	role, err := s.store.Role(ctx, albumID, actorID)
	if err != nil {
		return "", err
	}
	if role == "" {
		return "", httpx.NotFound("album_not_found", "album not found")
	}
	return role, nil
}

type CreateInviteInput struct {
	Role    string
	TTL     time.Duration
	MaxUses int
}

func (s *Service) CreateInvite(ctx context.Context, albumID, actorID string, in CreateInviteInput) (*models.Invite, error) {
	role, err := s.actorRole(ctx, albumID, actorID)
	if err != nil {
		return nil, err
	}
	if !roles.CanInvite(role, in.Role) {
		return nil, httpx.Forbidden("forbidden", "you cannot invite with this role")
	}
	if in.TTL <= 0 {
		in.TTL = 7 * 24 * time.Hour
	}
	if in.MaxUses <= 0 {
		in.MaxUses = 1
	}
	token, err := randomToken()
	if err != nil {
		return nil, err
	}
	inv := &models.Invite{
		ID:        auth.NewID(),
		AlbumID:   albumID,
		Token:     token,
		Role:      in.Role,
		CreatedBy: actorID,
		ExpiresAt: time.Now().Add(in.TTL),
		MaxUses:   in.MaxUses,
	}
	if err := s.store.CreateInvite(ctx, inv); err != nil {
		return nil, err
	}
	return inv, nil
}

func (s *Service) Accept(ctx context.Context, token, userID string) (*models.Invite, error) {
	inv, err := s.store.GetInviteByToken(ctx, token)
	if err != nil {
		if errors.Is(err, ErrNotFound) {
			return nil, httpx.NotFound("invite_not_found", "invite not found")
		}
		return nil, err
	}
	if time.Now().After(inv.ExpiresAt) {
		return nil, httpx.BadRequest("invite_expired", "invite has expired")
	}
	if inv.Uses >= inv.MaxUses {
		return nil, httpx.BadRequest("invite_exhausted", "invite has no remaining uses")
	}
	if err := s.store.Add(ctx, inv.AlbumID, userID, inv.Role, &inv.CreatedBy); err != nil {
		return nil, err
	}
	if err := s.store.IncrementUses(ctx, inv.ID); err != nil {
		return nil, err
	}
	s.hub.Publish(inv.AlbumID, "member.joined", map[string]string{"album_id": inv.AlbumID, "user_id": userID, "role": inv.Role})
	if s.notify != nil {
		ownerID, err := s.albums.OwnerID(ctx, inv.AlbumID)
		if err == nil && ownerID != userID {
			_ = s.notify.Create(ctx, ownerID, "member.joined", map[string]any{"album_id": inv.AlbumID, "user_id": userID, "role": inv.Role})
		}
	}
	return inv, nil
}

func (s *Service) List(ctx context.Context, albumID, actorID string) ([]models.AlbumMember, error) {
	if _, err := s.actorRole(ctx, albumID, actorID); err != nil {
		return nil, err
	}
	return s.store.List(ctx, albumID)
}

func (s *Service) InviteInfo(ctx context.Context, token string) (*models.Invite, error) {
	inv, err := s.store.GetInviteByToken(ctx, token)
	if err != nil {
		if errors.Is(err, ErrNotFound) {
			return nil, httpx.NotFound("invite_not_found", "invite not found")
		}
		return nil, err
	}
	if time.Now().After(inv.ExpiresAt) || inv.Uses >= inv.MaxUses {
		return nil, httpx.BadRequest("invite_inactive", "invite is expired or exhausted")
	}
	return inv, nil
}

func (s *Service) ChangeRole(ctx context.Context, albumID, actorID, targetID, newRole string) error {
	actor, err := s.actorRole(ctx, albumID, actorID)
	if err != nil {
		return err
	}
	current, err := s.store.Role(ctx, albumID, targetID)
	if err != nil {
		return err
	}
	if current == "" {
		if ownerID, oerr := s.albums.OwnerID(ctx, albumID); oerr == nil && ownerID == targetID {
			return httpx.Forbidden("forbidden", "cannot change the owner's role")
		}
		return httpx.NotFound("member_not_found", "member not found")
	}
	if !roles.CanChangeRole(actor, current, newRole) {
		return httpx.Forbidden("forbidden", "you cannot assign this role")
	}
	if err := s.store.UpdateRole(ctx, albumID, targetID, newRole); err != nil {
		if errors.Is(err, ErrNotFound) {
			return httpx.NotFound("member_not_found", "member not found")
		}
		return err
	}
	s.hub.Publish(albumID, "member.updated", map[string]string{"album_id": albumID, "user_id": targetID, "role": newRole})
	return nil
}

func (s *Service) Remove(ctx context.Context, albumID, actorID, targetID string) error {
	actor, err := s.actorRole(ctx, albumID, actorID)
	if err != nil {
		return err
	}
	targetRole, err := s.store.Role(ctx, albumID, targetID)
	if err != nil {
		return err
	}
	if targetRole == "" {
		if ownerID, oerr := s.albums.OwnerID(ctx, albumID); oerr == nil && ownerID == targetID {
			return httpx.Forbidden("forbidden", "cannot remove the album owner")
		}
		return httpx.NotFound("member_not_found", "member not found")
	}
	if !roles.CanRemoveMember(actor, targetRole) {
		return httpx.Forbidden("forbidden", "you cannot remove this member")
	}
	if err := s.store.Remove(ctx, albumID, targetID); err != nil {
		if errors.Is(err, ErrNotFound) {
			return httpx.NotFound("member_not_found", "member not found")
		}
		return err
	}
	s.hub.Publish(albumID, "member.left", map[string]string{"album_id": albumID, "user_id": targetID})
	return nil
}

func randomToken() (string, error) {
	raw, _, err := auth.NewRefreshToken()
	return raw, err
}