hanna/fabrica

feat(store): user-management queries for the CLI

6df0c07 · hanna committed on 2026-07-25

Add the mutations `fabrica user` needs: list_users (case-insensitive order),
set_password (clears must_change_password and deletes the user's sessions,
honouring the password-change session-invalidation rule), set_disabled (stamps
or clears disabled_at, dropping sessions on disable), delete_user (cascades to
repos/keys/tokens/sessions), and repos_by_owner (so `user del` can refuse and
enumerate owned repos). Tested over both SQLite fixtures.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

crates/store/src/repos.rs +18 −0

crates/store/src/tests.rs +168 −0

crates/store/src/users.rs +106 −0

         Ok(row.as_ref().map(|r| self.map_repo(r)).transpose()?)
+    }
+    /// List every repository owned by `owner_id`, ordered by path. Used by
+    /// `fabrica user del` to refuse (and enumerate) when a user still owns repos.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn repos_by_owner(&self, owner_id: &str) -> Result<Vec<Repo>, StoreError> {
+        let sql = format!("SELECT {REPO_COLUMNS} FROM repos WHERE owner_id = $1 ORDER BY path ASC");
+        let rows = sqlx::query(AssertSqlSafe(sql))
+            .bind(owner_id)
+            .fetch_all(&self.pool)
+            .await?;
+        rows.iter()
+            .map(|r| self.map_repo(r))
+            .collect::<Result<_, _>>()
+            .map_err(Into::into)
+    }
     /// Map a `repos` row (selected via [`REPO_COLUMNS`]) to a [`Repo`].
     fn map_repo(&self, row: &AnyRow) -> Result<Repo, sqlx::Error> {
         Ok(Repo {

+    }
+}
+/// Insert a bare session row for `user_id` so the session-deletion side effects
+/// of `set_password`/`set_disabled` can be observed. Returns nothing; the count
+/// is read back with [`session_count`].
+async fn insert_session(store: &Store, user_id: &str) {
+    sqlx::query(
+        "INSERT INTO sessions (id, user_id, created_at, last_seen_at, expires_at) \
+         VALUES ($1, $2, 0, 0, 0)",
+    )
+    .bind(super::new_id())
+    .bind(user_id)
+    .execute(store.pool())
+    .await
+    .unwrap();
+}
+async fn session_count(store: &Store, user_id: &str) -> i64 {
+    sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM sessions WHERE user_id = $1")
+        .bind(user_id)
+        .fetch_one(store.pool())
+        .await
+        .unwrap()
+}
+#[tokio::test]
+async fn set_password_sets_clears_and_kills_sessions() {
+    for fx in sqlite_fixtures().await {
+        let user = fx
+            .store
+            .create_user(sample_user("pw", "pw@example.com"))
+            .await
+            .unwrap();
+        assert!(user.password_hash.is_none());
+        insert_session(&fx.store, &user.id).await;
+        assert_eq!(session_count(&fx.store, &user.id).await, 1);
+        // Setting a hash records it, clears must_change_password, and wipes
+        // sessions.
+        assert!(
+            fx.store
+                .set_password(&user.id, Some("$argon2id$fake"))
+                .await
+                .unwrap()
+        );
+        let after = fx.store.user_by_id(&user.id).await.unwrap().unwrap();
+        assert_eq!(after.password_hash.as_deref(), Some("$argon2id$fake"));
+        assert!(!after.must_change_password);
+        assert!(after.updated_at >= user.updated_at);
+        assert_eq!(session_count(&fx.store, &user.id).await, 0);
+        // Clearing it returns to the invite-pending state.
+        assert!(fx.store.set_password(&user.id, None).await.unwrap());
+        let cleared = fx.store.user_by_id(&user.id).await.unwrap().unwrap();
+        assert!(cleared.password_hash.is_none());
+        // A missing user reports no update.
+        assert!(!fx.store.set_password("ghost", Some("x")).await.unwrap());
+    }
+}
+#[tokio::test]
+async fn set_disabled_toggles_and_kills_sessions() {
+    for fx in sqlite_fixtures().await {
+        let user = fx
+            .store
+            .create_user(sample_user("dis", "dis@example.com"))
+            .await
+            .unwrap();
+        insert_session(&fx.store, &user.id).await;
+        assert!(fx.store.set_disabled(&user.id, true).await.unwrap());
+        let disabled = fx.store.user_by_id(&user.id).await.unwrap().unwrap();
+        assert!(disabled.disabled_at.is_some());
+        assert_eq!(session_count(&fx.store, &user.id).await, 0);
+        assert!(fx.store.set_disabled(&user.id, false).await.unwrap());
+        let enabled = fx.store.user_by_id(&user.id).await.unwrap().unwrap();
+        assert!(enabled.disabled_at.is_none());
+        assert!(!fx.store.set_disabled("ghost", true).await.unwrap());
+    }
+}
+#[tokio::test]
+async fn list_users_is_sorted_case_insensitively() {
+    for fx in sqlite_fixtures().await {
+        for name in ["Charlie", "alice", "Bob"] {
+            fx.store
+                .create_user(sample_user(name, &format!("{name}@example.com")))
+                .await
+                .unwrap();
+        }
+        let names: Vec<String> = fx
+            .store
+            .list_users()
+            .await
+            .unwrap()
+            .into_iter()
+            .map(|u| u.username)
+            .collect();
+        assert_eq!(names, ["alice", "Bob", "Charlie"]);
+    }
+}
+#[tokio::test]
+async fn delete_user_cascades_to_repos() {
+    for fx in sqlite_fixtures().await {
+        let user = fx
+            .store
+            .create_user(sample_user("gone", "gone@example.com"))
+            .await
+            .unwrap();
+        fx.store
+            .create_repo(NewRepo {
+                owner_id: user.id.clone(),
+                group_id: None,
+                name: "r".to_string(),
+                path: "r".to_string(),
+                description: None,
+                is_private: true,
+                default_branch: "main".to_string(),
+            })
+            .await
+            .unwrap();
+        assert!(fx.store.delete_user(&user.id).await.unwrap());
+        assert!(fx.store.user_by_id(&user.id).await.unwrap().is_none());
+        assert!(
+            fx.store.repos_by_owner(&user.id).await.unwrap().is_empty(),
+            "the repo should cascade away with its owner"
+        );
+        assert!(!fx.store.delete_user(&user.id).await.unwrap());
+    }
+}
+#[tokio::test]
+async fn repos_by_owner_lists_in_path_order() {
+    for fx in sqlite_fixtures().await {
+        let owner = fx
+            .store
+            .create_user(sample_user("multi", "multi@example.com"))
+            .await
+            .unwrap();
+        for name in ["zeta", "alpha", "mu"] {
+            fx.store
+                .create_repo(NewRepo {
+                    owner_id: owner.id.clone(),
+                    group_id: None,
+                    name: name.to_string(),
+                    path: name.to_string(),
+                    description: None,
+                    is_private: true,
+                    default_branch: "main".to_string(),
+                })
+                .await
+                .unwrap();
+        }
+        let paths: Vec<String> = fx
+            .store
+            .repos_by_owner(&owner.id)
+            .await
+            .unwrap()
+            .into_iter()
+            .map(|r| r.path)
+            .collect();
+        assert_eq!(paths, ["alpha", "mu", "zeta"]);
+    }
+}
 #[tokio::test]
 async fn create_and_fetch_repo() {
     for fx in sqlite_fixtures().await {

         Ok(row.as_ref().map(|r| self.map_user(r)).transpose()?)
+    }
+    /// List all users, ordered case-insensitively by username.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn list_users(&self) -> Result<Vec<User>, StoreError> {
+        let sql = format!("SELECT {USER_COLUMNS} FROM users ORDER BY username_lower ASC");
+        let rows = sqlx::query(AssertSqlSafe(sql))
+            .fetch_all(&self.pool)
+            .await?;
+        rows.iter()
+            .map(|r| self.map_user(r))
+            .collect::<Result<_, _>>()
+            .map_err(Into::into)
+    }
+    /// Set (or clear) a user's password hash.
+    ///
+    /// Passing `Some(hash)` sets the credential and clears the
+    /// `must_change_password` flag — the operator has just chosen a known
+    /// password. Passing `None` returns the account to the invite-pending state.
+    /// Either way, **all of the user's sessions are deleted**, as required on any
+    /// password change, so a rotated credential immediately invalidates existing
+    /// logins.
+    ///
+    /// Returns `true` if a user with `user_id` existed and was updated.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn set_password(
+        &self,
+        user_id: &str,
+        password_hash: Option<&str>,
+    ) -> Result<bool, StoreError> {
+        let updated = sqlx::query(
+            "UPDATE users SET password_hash = $1, must_change_password = $2, updated_at = $3 \
+             WHERE id = $4",
+        )
+        .bind(password_hash)
+        .bind(false)
+        .bind(now_ms())
+        .bind(user_id)
+        .execute(&self.pool)
+        .await?
+        .rows_affected();
+        // Invalidate every existing session for the user (best-effort — the row
+        // may simply not have existed).
+        sqlx::query("DELETE FROM sessions WHERE user_id = $1")
+            .bind(user_id)
+            .execute(&self.pool)
+            .await?;
+        Ok(updated > 0)
+    }
+    /// Enable or disable a user. Disabling stamps `disabled_at` with the current
+    /// time and deletes the user's sessions; enabling clears `disabled_at`.
+    ///
+    /// Returns `true` if a user with `user_id` existed and was updated.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn set_disabled(&self, user_id: &str, disabled: bool) -> Result<bool, StoreError> {
+        let now = now_ms();
+        let disabled_at = disabled.then_some(now);
+        let updated =
+            sqlx::query("UPDATE users SET disabled_at = $1, updated_at = $2 WHERE id = $3")
+                .bind(disabled_at)
+                .bind(now)
+                .bind(user_id)
+                .execute(&self.pool)
+                .await?
+                .rows_affected();
+        if disabled {
+            sqlx::query("DELETE FROM sessions WHERE user_id = $1")
+                .bind(user_id)
+                .execute(&self.pool)
+                .await?;
+        }
+        Ok(updated > 0)
+    }
+    /// Delete a user by id, cascading to their repositories, keys, tokens, and
+    /// sessions (via `ON DELETE CASCADE`). The caller is responsible for any
+    /// policy that should *prevent* the delete (e.g. refusing when repos exist
+    /// and `--purge` was not given).
+    ///
+    /// Returns `true` if a user was deleted.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn delete_user(&self, user_id: &str) -> Result<bool, StoreError> {
+        let deleted = sqlx::query("DELETE FROM users WHERE id = $1")
+            .bind(user_id)
+            .execute(&self.pool)
+            .await?
+            .rows_affected();
+        Ok(deleted > 0)
+    }
     /// Map a `users` row (selected via [`USER_COLUMNS`]) to a [`User`].
     fn map_user(&self, row: &AnyRow) -> Result<User, sqlx::Error> {
         Ok(User {