forked from baron/baron-sso
1825 lines
56 KiB
Go
1825 lines
56 KiB
Go
package handler
|
|
|
|
import (
|
|
"baron-sso-backend/internal/domain"
|
|
"baron-sso-backend/internal/repository"
|
|
"baron-sso-backend/internal/service"
|
|
"baron-sso-backend/internal/utils"
|
|
"context"
|
|
"encoding/csv"
|
|
"errors"
|
|
"fmt"
|
|
"log/slog"
|
|
"net/http"
|
|
"os"
|
|
"regexp"
|
|
"strconv"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/gofiber/fiber/v2"
|
|
)
|
|
|
|
// OryProviderAPI defines the subset of Ory Provider used by UserHandler
|
|
type OryProviderAPI interface {
|
|
CreateUser(user *domain.BrokerUser, password string) (string, error)
|
|
UpdateUserPassword(loginID, newPassword string, r *http.Request) error
|
|
GetPasswordPolicy() (*domain.PasswordPolicy, error)
|
|
}
|
|
|
|
type UserHandler struct {
|
|
KratosAdmin service.KratosAdminService
|
|
OryProvider OryProviderAPI
|
|
TenantService service.TenantService
|
|
KetoService service.KetoService
|
|
KetoOutboxRepo repository.KetoOutboxRepository
|
|
UserRepo repository.UserRepository
|
|
UserGroupRepo repository.UserGroupRepository
|
|
}
|
|
|
|
func NewUserHandler(kratosAdmin service.KratosAdminService, oryProvider OryProviderAPI, tenantService service.TenantService, ketoService service.KetoService, ketoOutboxRepo repository.KetoOutboxRepository, userRepo repository.UserRepository, userGroupRepo repository.UserGroupRepository) *UserHandler {
|
|
return &UserHandler{
|
|
KratosAdmin: kratosAdmin,
|
|
OryProvider: oryProvider,
|
|
TenantService: tenantService,
|
|
KetoService: ketoService,
|
|
KetoOutboxRepo: ketoOutboxRepo,
|
|
UserRepo: userRepo,
|
|
UserGroupRepo: userGroupRepo,
|
|
}
|
|
}
|
|
|
|
type userSummary struct {
|
|
ID string `json:"id"`
|
|
Email string `json:"email"`
|
|
Name string `json:"name"`
|
|
Phone string `json:"phone"`
|
|
Role string `json:"role"`
|
|
Status string `json:"status"`
|
|
CompanyCode string `json:"companyCode"`
|
|
Metadata domain.JSONMap `json:"metadata,omitempty"`
|
|
Tenant *domain.Tenant `json:"tenant,omitempty"`
|
|
JoinedTenants []domain.Tenant `json:"joinedTenants,omitempty"` // [New] 다중 소속 테넌트 목록
|
|
Department string `json:"department"`
|
|
Position string `json:"position"`
|
|
JobTitle string `json:"jobTitle"`
|
|
CreatedAt string `json:"createdAt"`
|
|
UpdatedAt string `json:"updatedAt"`
|
|
InitialPassword string `json:"initialPassword,omitempty"`
|
|
}
|
|
|
|
type userListResponse struct {
|
|
Items []userSummary `json:"items"`
|
|
Limit int `json:"limit"`
|
|
Offset int `json:"offset"`
|
|
Total int64 `json:"total"`
|
|
}
|
|
|
|
func (h *UserHandler) ListUsers(c *fiber.Ctx) error {
|
|
// [New] Get requester profile from middleware
|
|
var requesterRole string
|
|
if profile, ok := c.Locals("user_profile").(*domain.UserProfileResponse); ok {
|
|
requesterRole = domain.NormalizeRole(profile.Role)
|
|
}
|
|
|
|
limit := c.QueryInt("limit", 50)
|
|
offset := c.QueryInt("offset", 0)
|
|
search := strings.TrimSpace(c.Query("search"))
|
|
tenantSlug := strings.TrimSpace(c.Query("tenantSlug"))
|
|
|
|
if limit <= 0 {
|
|
limit = 50
|
|
}
|
|
if offset < 0 {
|
|
offset = 0
|
|
}
|
|
|
|
// [New] Manageable Tenants Map for efficient lookup
|
|
manageableSlugs := make(map[string]bool)
|
|
if requesterRole == domain.RoleTenantAdmin {
|
|
profile, _ := c.Locals("user_profile").(*domain.UserProfileResponse)
|
|
if profile != nil {
|
|
for _, t := range profile.ManageableTenants {
|
|
manageableSlugs[strings.ToLower(t.Slug)] = true
|
|
}
|
|
// Include primary tenant slug if not already there
|
|
if profile.CompanyCode != "" {
|
|
manageableSlugs[strings.ToLower(profile.CompanyCode)] = true
|
|
}
|
|
}
|
|
}
|
|
|
|
// 1. Try Kratos First
|
|
identities, err := h.KratosAdmin.ListIdentities(c.Context())
|
|
if err == nil {
|
|
filtered := make([]service.KratosIdentity, 0, len(identities))
|
|
searchLower := strings.ToLower(search)
|
|
|
|
for _, identity := range identities {
|
|
email := strings.ToLower(extractTraitString(identity.Traits, "email"))
|
|
name := strings.ToLower(extractTraitString(identity.Traits, "name"))
|
|
compCode := strings.ToLower(extractTraitString(identity.Traits, "companyCode"))
|
|
|
|
// Tenant Admin filtering
|
|
if requesterRole == domain.RoleTenantAdmin {
|
|
if !manageableSlugs[compCode] {
|
|
continue
|
|
}
|
|
}
|
|
|
|
// Dedicated tenantSlug filter
|
|
if tenantSlug != "" && !strings.EqualFold(compCode, tenantSlug) {
|
|
continue
|
|
}
|
|
|
|
// Search filtering (Keyword search in email, name, or companyCode)
|
|
if search != "" {
|
|
if !strings.Contains(email, searchLower) &&
|
|
!strings.Contains(name, searchLower) &&
|
|
!strings.Contains(strings.ToLower(compCode), searchLower) {
|
|
continue
|
|
}
|
|
}
|
|
filtered = append(filtered, identity)
|
|
}
|
|
|
|
total := int64(len(filtered))
|
|
if offset > len(filtered) {
|
|
offset = len(filtered)
|
|
}
|
|
end := offset + limit
|
|
if end > len(filtered) {
|
|
end = len(filtered)
|
|
}
|
|
|
|
items := make([]userSummary, 0, end-offset)
|
|
for _, identity := range filtered[offset:end] {
|
|
summary := h.mapIdentitySummary(c.Context(), identity)
|
|
items = append(items, summary)
|
|
}
|
|
|
|
// [Lazy Sync] Asynchronously update local DB with fresh data from Kratos
|
|
// This ensures that member counts (which use local DB) eventually match reality
|
|
if h.UserRepo != nil {
|
|
go func(ids []service.KratosIdentity) {
|
|
ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
|
|
defer cancel()
|
|
for _, identity := range ids {
|
|
localUser := h.mapToLocalUser(identity)
|
|
_ = h.UserRepo.Update(ctx, localUser)
|
|
}
|
|
}(filtered)
|
|
}
|
|
|
|
return c.JSON(userListResponse{Items: items, Limit: limit, Offset: offset, Total: total})
|
|
}
|
|
|
|
// 2. Fallback to Local DB if Kratos is down
|
|
slog.Warn("Kratos unavailable, falling back to local DB for user list", "error", err)
|
|
|
|
// Fetch from UserRepo
|
|
users, total, err := h.UserRepo.List(c.Context(), offset, limit, search, tenantSlug)
|
|
if err != nil {
|
|
return errorJSON(c, fiber.StatusInternalServerError, "failed to fetch users from both kratos and local db")
|
|
}
|
|
|
|
items := make([]userSummary, 0, len(users))
|
|
for _, u := range users {
|
|
items = append(items, userSummary{
|
|
ID: u.ID,
|
|
Email: u.Email,
|
|
Name: u.Name,
|
|
Phone: u.Phone,
|
|
Role: u.Role,
|
|
Status: u.Status,
|
|
CompanyCode: u.CompanyCode,
|
|
Department: u.Department,
|
|
CreatedAt: u.CreatedAt.Format(time.RFC3339),
|
|
UpdatedAt: u.UpdatedAt.Format(time.RFC3339),
|
|
})
|
|
}
|
|
|
|
return c.JSON(userListResponse{
|
|
Items: items,
|
|
Total: total,
|
|
Limit: limit,
|
|
Offset: offset,
|
|
})
|
|
}
|
|
|
|
func (h *UserHandler) GetUser(c *fiber.Ctx) error {
|
|
if h.KratosAdmin == nil {
|
|
return errorJSON(c, fiber.StatusServiceUnavailable, "identity provider not available")
|
|
}
|
|
|
|
userID := strings.TrimSpace(c.Params("id"))
|
|
if userID == "" {
|
|
return errorJSON(c, fiber.StatusBadRequest, "user id is required")
|
|
}
|
|
|
|
identity, err := h.KratosAdmin.GetIdentity(c.Context(), userID)
|
|
if err != nil {
|
|
return errorJSON(c, fiber.StatusInternalServerError, err.Error())
|
|
}
|
|
if identity == nil {
|
|
return errorJSON(c, fiber.StatusNotFound, "user not found")
|
|
}
|
|
|
|
// [New] Check access scope
|
|
requester, _ := c.Locals("user_profile").(*domain.UserProfileResponse)
|
|
if requester != nil && requester.Role == domain.RoleTenantAdmin {
|
|
compCode := strings.ToLower(extractTraitString(identity.Traits, "companyCode"))
|
|
|
|
// Check if the target user's companyCode is in requester's manageable tenants
|
|
allowed := false
|
|
for _, t := range requester.ManageableTenants {
|
|
if strings.ToLower(t.Slug) == compCode {
|
|
allowed = true
|
|
break
|
|
}
|
|
}
|
|
// Also check primary company code
|
|
if !allowed && strings.ToLower(requester.CompanyCode) == compCode {
|
|
allowed = true
|
|
}
|
|
|
|
if !allowed {
|
|
return errorJSON(c, fiber.StatusForbidden, "forbidden: access to user in another tenant denied")
|
|
}
|
|
}
|
|
|
|
return c.JSON(h.mapIdentitySummary(c.Context(), *identity))
|
|
}
|
|
|
|
func (h *UserHandler) CreateUser(c *fiber.Ctx) error {
|
|
if h.OryProvider == nil || h.KratosAdmin == nil {
|
|
return errorJSON(c, fiber.StatusServiceUnavailable, "identity provider not available")
|
|
}
|
|
|
|
var req struct {
|
|
Email string `json:"email"`
|
|
LoginID string `json:"loginId"`
|
|
Password string `json:"password"`
|
|
Name string `json:"name"`
|
|
Phone string `json:"phone"`
|
|
Role string `json:"role"`
|
|
CompanyCode string `json:"companyCode"`
|
|
Department string `json:"department"`
|
|
Metadata map[string]any `json:"metadata"`
|
|
}
|
|
if err := c.BodyParser(&req); err != nil {
|
|
return errorJSON(c, fiber.StatusBadRequest, "invalid request body")
|
|
}
|
|
|
|
email := strings.TrimSpace(req.Email)
|
|
if email == "" {
|
|
return errorJSON(c, fiber.StatusBadRequest, "email is required")
|
|
}
|
|
if !strings.Contains(email, "@") || !strings.Contains(email, ".") {
|
|
return errorJSON(c, fiber.StatusBadRequest, "invalid email format")
|
|
}
|
|
name := strings.TrimSpace(req.Name)
|
|
if name == "" {
|
|
return errorJSON(c, fiber.StatusBadRequest, "name is required")
|
|
}
|
|
|
|
password := strings.TrimSpace(req.Password)
|
|
policy, err := h.OryProvider.GetPasswordPolicy()
|
|
if err != nil || policy == nil {
|
|
policy = &domain.PasswordPolicy{
|
|
MinLength: 12,
|
|
Lowercase: true,
|
|
Uppercase: false,
|
|
Number: true,
|
|
NonAlphanumeric: true,
|
|
MinCharacterTypes: 0,
|
|
}
|
|
}
|
|
|
|
generatedPassword := ""
|
|
if password == "" {
|
|
generated, genErr := utils.GeneratePasswordWithPolicy(policy)
|
|
if genErr != nil {
|
|
return errorJSON(c, fiber.StatusInternalServerError, "failed to generate password")
|
|
}
|
|
password = generated
|
|
generatedPassword = generated
|
|
} else {
|
|
if err := utils.ValidatePasswordWithPolicy(policy, password); err != nil {
|
|
return errorJSON(c, fiber.StatusBadRequest, err.Error())
|
|
}
|
|
}
|
|
|
|
role := domain.NormalizeRole(req.Role)
|
|
if role == "" {
|
|
role = domain.RoleUser
|
|
}
|
|
|
|
attributes := map[string]interface{}{
|
|
"department": req.Department,
|
|
"affiliationType": "internal",
|
|
"companyCode": req.CompanyCode,
|
|
"grade": role,
|
|
}
|
|
|
|
// [Override with explicit LoginID if provided]
|
|
if req.LoginID != "" {
|
|
attributes["id"] = req.LoginID
|
|
}
|
|
|
|
// [Resolve TenantID and LoginID before Kratos creation]
|
|
var tenantID string
|
|
if req.CompanyCode != "" && h.TenantService != nil {
|
|
if tenant, err := h.TenantService.GetTenantBySlug(c.Context(), req.CompanyCode); err == nil && tenant != nil {
|
|
tenantID = tenant.ID
|
|
|
|
// Sync custom field to LoginID if configured
|
|
if loginIdField, ok := tenant.Config["loginIdField"].(string); ok && loginIdField != "" {
|
|
syncLoginID(attributes, req.Metadata, tenantID, loginIdField)
|
|
}
|
|
}
|
|
}
|
|
attributes["role"] = role
|
|
if tenantID != "" {
|
|
attributes["tenant_id"] = tenantID
|
|
}
|
|
|
|
// Merge custom metadata into attributes
|
|
for k, v := range req.Metadata {
|
|
// Don't overwrite core fields
|
|
if _, exists := attributes[k]; !exists {
|
|
attributes[k] = v
|
|
}
|
|
}
|
|
|
|
finalLoginID := extractTraitString(attributes, "id")
|
|
if err := domain.ValidateLoginID(finalLoginID, email, normalizePhoneNumber(req.Phone)); err != nil {
|
|
return errorJSON(c, fiber.StatusBadRequest, err.Error())
|
|
}
|
|
|
|
brokerUser := &domain.BrokerUser{
|
|
Email: email,
|
|
LoginID: finalLoginID,
|
|
Name: name,
|
|
PhoneNumber: normalizePhoneNumber(req.Phone),
|
|
Attributes: attributes,
|
|
}
|
|
|
|
// [Validation] Based on Tenant Schema
|
|
if req.CompanyCode != "" && h.TenantService != nil {
|
|
tenant, err := h.TenantService.GetTenantBySlug(c.Context(), req.CompanyCode)
|
|
if err == nil && tenant != nil {
|
|
if schema, ok := tenant.Config["userSchema"].([]interface{}); ok {
|
|
if err := h.validateMetadata(req.Metadata, schema, true); err != nil {
|
|
return errorJSON(c, fiber.StatusBadRequest, "metadata validation failed: "+err.Error())
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
identityID, err := h.OryProvider.CreateUser(brokerUser, password)
|
|
if err != nil {
|
|
if strings.Contains(err.Error(), "already exists") {
|
|
return errorJSON(c, fiber.StatusConflict, "email already exists")
|
|
}
|
|
return errorJSON(c, fiber.StatusInternalServerError, err.Error())
|
|
}
|
|
|
|
// Fetch the newly created identity to ensure we have all traits
|
|
identity, err := h.KratosAdmin.GetIdentity(c.Context(), identityID)
|
|
if err != nil {
|
|
return errorJSON(c, fiber.StatusInternalServerError, err.Error())
|
|
}
|
|
if identity == nil {
|
|
return c.Status(fiber.StatusCreated).JSON(fiber.Map{"id": identityID, "initialPassword": generatedPassword})
|
|
}
|
|
|
|
// [New] Local DB Sync - Ensure user exists in read-model
|
|
if h.UserRepo != nil {
|
|
localUser := h.mapToLocalUser(*identity)
|
|
|
|
// Sync to local DB (Synchronous for immediate consistency)
|
|
if err := h.UserRepo.Update(c.Context(), localUser); err != nil {
|
|
slog.Error("[UserHandler] Failed to sync new user to local DB", "email", localUser.Email, "error", err)
|
|
}
|
|
|
|
// [Keto] Sync relations via Outbox (Synchronous for accurate counting)
|
|
if h.KetoOutboxRepo != nil {
|
|
// 1. Role based relations
|
|
h.syncKetoRole(c.Context(), localUser.ID, role, "", "", localUser.TenantID)
|
|
|
|
// 2. Direct membership to the Tenant (for accurate counting)
|
|
if localUser.TenantID != nil && *localUser.TenantID != "" {
|
|
_ = h.KetoOutboxRepo.Create(c.Context(), &domain.KetoOutbox{
|
|
Namespace: "Tenant",
|
|
Object: *localUser.TenantID,
|
|
Relation: "members",
|
|
Subject: "User:" + localUser.ID,
|
|
Action: domain.KetoOutboxActionCreate,
|
|
})
|
|
}
|
|
}
|
|
}
|
|
|
|
response := h.mapIdentitySummary(c.Context(), *identity)
|
|
if generatedPassword != "" {
|
|
response.InitialPassword = generatedPassword
|
|
}
|
|
return c.Status(fiber.StatusCreated).JSON(response)
|
|
}
|
|
|
|
type bulkUserItem struct {
|
|
Email string `json:"email"`
|
|
LoginID string `json:"loginId"`
|
|
Name string `json:"name"`
|
|
Phone string `json:"phone"`
|
|
Role string `json:"role"`
|
|
TenantSlug string `json:"tenantSlug"`
|
|
Department string `json:"department"`
|
|
Metadata map[string]any `json:"metadata"`
|
|
}
|
|
|
|
type bulkUserResult struct {
|
|
Email string `json:"email"`
|
|
Success bool `json:"success"`
|
|
Message string `json:"message,omitempty"`
|
|
UserID string `json:"userId,omitempty"`
|
|
}
|
|
|
|
func (h *UserHandler) BulkCreateUsers(c *fiber.Ctx) error {
|
|
if h.OryProvider == nil || h.KratosAdmin == nil {
|
|
return errorJSON(c, fiber.StatusServiceUnavailable, "identity provider not available")
|
|
}
|
|
|
|
var req struct {
|
|
Users []bulkUserItem `json:"users"`
|
|
}
|
|
if err := c.BodyParser(&req); err != nil {
|
|
return errorJSON(c, fiber.StatusBadRequest, "invalid request body")
|
|
}
|
|
|
|
if len(req.Users) == 0 {
|
|
return errorJSON(c, fiber.StatusBadRequest, "no users provided")
|
|
}
|
|
|
|
policy, err := h.OryProvider.GetPasswordPolicy()
|
|
if err != nil || policy == nil {
|
|
policy = &domain.PasswordPolicy{
|
|
MinLength: 12, Number: true, NonAlphanumeric: true,
|
|
}
|
|
}
|
|
|
|
requester, _ := c.Locals("user_profile").(*domain.UserProfileResponse)
|
|
results := make([]bulkUserResult, 0, len(req.Users))
|
|
|
|
// Pre-fetch tenant data to avoid redundant DB calls
|
|
type tenantCacheItem struct {
|
|
ID string
|
|
Schema []interface{}
|
|
Groups []domain.UserGroup
|
|
LoginIDField string
|
|
}
|
|
tenantCache := make(map[string]tenantCacheItem)
|
|
|
|
for _, item := range req.Users {
|
|
email := strings.TrimSpace(item.Email)
|
|
name := strings.TrimSpace(item.Name)
|
|
tenantSlug := strings.TrimSpace(item.TenantSlug)
|
|
dept := strings.TrimSpace(item.Department)
|
|
|
|
if email == "" || name == "" {
|
|
results = append(results, bulkUserResult{Email: email, Success: false, Message: "email and name are required"})
|
|
continue
|
|
}
|
|
|
|
if tenantSlug == "" {
|
|
results = append(results, bulkUserResult{Email: email, Success: false, Message: "tenantSlug is required"})
|
|
continue
|
|
}
|
|
|
|
// Role-based access check
|
|
if requester != nil && requester.Role == domain.RoleTenantAdmin {
|
|
if tenantSlug != requester.CompanyCode {
|
|
results = append(results, bulkUserResult{Email: email, Success: false, Message: "forbidden: cannot add users to another tenant"})
|
|
continue
|
|
}
|
|
}
|
|
|
|
// Verify Tenant Existence and Resolve ID (with Cache)
|
|
var tItem tenantCacheItem
|
|
var exists bool
|
|
if tItem, exists = tenantCache[tenantSlug]; !exists {
|
|
if h.TenantService != nil {
|
|
tenant, err := h.TenantService.GetTenantBySlug(c.Context(), tenantSlug)
|
|
if err != nil || tenant == nil {
|
|
results = append(results, bulkUserResult{Email: email, Success: false, Message: "invalid tenantSlug: tenant not found"})
|
|
continue
|
|
}
|
|
tItem.ID = tenant.ID
|
|
if s, ok := tenant.Config["userSchema"].([]interface{}); ok {
|
|
tItem.Schema = s
|
|
}
|
|
if lf, ok := tenant.Config["loginIdField"].(string); ok {
|
|
tItem.LoginIDField = lf
|
|
}
|
|
// [Fix] Cache user groups for this tenant to match department
|
|
if h.UserGroupRepo != nil {
|
|
if groups, err := h.UserGroupRepo.ListByTenantID(c.Context(), tenant.ID); err == nil {
|
|
tItem.Groups = groups
|
|
}
|
|
}
|
|
|
|
tenantCache[tenantSlug] = tItem
|
|
} else {
|
|
results = append(results, bulkUserResult{Email: email, Success: false, Message: "tenant service unavailable"})
|
|
continue
|
|
}
|
|
}
|
|
|
|
// Validation based on schema
|
|
if tItem.Schema != nil {
|
|
if err := h.validateMetadata(item.Metadata, tItem.Schema, true); err != nil {
|
|
results = append(results, bulkUserResult{Email: email, Success: false, Message: "validation failed: " + err.Error()})
|
|
continue
|
|
}
|
|
}
|
|
|
|
password, _ := utils.GeneratePasswordWithPolicy(policy)
|
|
role := item.Role
|
|
if role == "" {
|
|
role = "user"
|
|
}
|
|
|
|
attributes := map[string]interface{}{
|
|
"department": dept,
|
|
"affiliationType": "internal",
|
|
"companyCode": tenantSlug,
|
|
"tenant_id": tItem.ID,
|
|
"grade": role,
|
|
"role": role,
|
|
}
|
|
|
|
// Override with explicit LoginID if provided
|
|
if item.LoginID != "" {
|
|
attributes["id"] = item.LoginID
|
|
}
|
|
|
|
// Sync LoginID from configured custom field (overrides explicit LoginID)
|
|
if tItem.LoginIDField != "" {
|
|
syncLoginID(attributes, item.Metadata, tItem.ID, tItem.LoginIDField)
|
|
}
|
|
|
|
// Merge metadata
|
|
for k, v := range item.Metadata {
|
|
if _, exists := attributes[k]; !exists {
|
|
attributes[k] = v
|
|
}
|
|
}
|
|
|
|
finalLoginID := extractTraitString(attributes, "id")
|
|
userEmail := email
|
|
userPhone := normalizePhoneNumber(item.Phone)
|
|
|
|
if err := domain.ValidateLoginID(finalLoginID, userEmail, userPhone); err != nil {
|
|
results = append(results, bulkUserResult{Email: email, Success: false, Message: err.Error()})
|
|
continue
|
|
}
|
|
|
|
identityID, err := h.OryProvider.CreateUser(&domain.BrokerUser{
|
|
Email: userEmail,
|
|
LoginID: finalLoginID,
|
|
Name: item.Name,
|
|
PhoneNumber: userPhone,
|
|
Attributes: attributes,
|
|
}, password)
|
|
if err != nil {
|
|
// 만약 이미 존재하는 사용자라면 로컬 DB 및 Keto 관계만 업데이트(Sync)를 시도
|
|
if strings.Contains(err.Error(), "already exists") {
|
|
identityID, err = h.KratosAdmin.FindIdentityIDByIdentifier(c.Context(), email)
|
|
if err != nil || identityID == "" {
|
|
results = append(results, bulkUserResult{Email: email, Success: false, Message: "이미 존재하는 사용자지만 ID를 찾을 수 없습니다."})
|
|
continue
|
|
}
|
|
slog.Info("BulkCreate: User already exists, syncing local DB and Keto", "email", email, "identityID", identityID)
|
|
} else {
|
|
results = append(results, bulkUserResult{Email: email, Success: false, Message: err.Error()})
|
|
continue
|
|
}
|
|
}
|
|
|
|
// [CRITICAL FIX] Sync to local DB directly using current data
|
|
// Don't fetch from Kratos here as it might have propagation lag
|
|
if h.UserRepo != nil {
|
|
localUser := &domain.User{
|
|
ID: identityID,
|
|
Email: email,
|
|
LoginID: extractTraitString(attributes, "id"),
|
|
Name: name,
|
|
Phone: normalizePhoneNumber(item.Phone),
|
|
Role: role,
|
|
Status: "active",
|
|
CompanyCode: tenantSlug,
|
|
Department: dept,
|
|
AffiliationType: "internal",
|
|
CreatedAt: time.Now(),
|
|
UpdatedAt: time.Now(),
|
|
}
|
|
|
|
if tItem.ID != "" {
|
|
localUser.TenantID = &tItem.ID
|
|
}
|
|
|
|
// Merge metadata
|
|
localUser.Metadata = make(domain.JSONMap)
|
|
for k, v := range item.Metadata {
|
|
localUser.Metadata[k] = v
|
|
}
|
|
|
|
if err := h.UserRepo.Update(c.Context(), localUser); err != nil {
|
|
slog.Error("Failed to sync bulk user to local DB", "email", email, "error", err)
|
|
}
|
|
|
|
if h.KetoOutboxRepo != nil {
|
|
// 1. Sync Role based relationship
|
|
h.syncKetoRole(c.Context(), localUser.ID, role, "", "", localUser.TenantID)
|
|
|
|
// 2. Sync direct membership to the Tenant (for count)
|
|
if localUser.TenantID != nil && *localUser.TenantID != "" {
|
|
_ = h.KetoOutboxRepo.Create(c.Context(), &domain.KetoOutbox{
|
|
Namespace: "Tenant",
|
|
Object: *localUser.TenantID,
|
|
Relation: "members",
|
|
Subject: "User:" + localUser.ID,
|
|
Action: domain.KetoOutboxActionCreate,
|
|
})
|
|
}
|
|
|
|
// 3. Sync membership to UserGroup if department matches
|
|
if dept != "" {
|
|
for _, g := range tItem.Groups {
|
|
if strings.EqualFold(strings.TrimSpace(g.Name), dept) {
|
|
_ = h.KetoOutboxRepo.Create(c.Context(), &domain.KetoOutbox{
|
|
Namespace: "Tenant",
|
|
Object: g.ID,
|
|
Relation: "members",
|
|
Subject: "User:" + localUser.ID,
|
|
Action: domain.KetoOutboxActionCreate,
|
|
})
|
|
break
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
results = append(results, bulkUserResult{Email: email, Success: true, UserID: identityID})
|
|
}
|
|
|
|
return c.Status(fiber.StatusOK).JSON(fiber.Map{
|
|
"results": results,
|
|
})
|
|
}
|
|
|
|
func (h *UserHandler) ExportUsersCSV(c *fiber.Ctx) error {
|
|
search := strings.TrimSpace(c.Query("search"))
|
|
companyCode := strings.TrimSpace(c.Query("companyCode"))
|
|
|
|
var requesterRole string
|
|
var manageableSlugs []string
|
|
var profile *domain.UserProfileResponse
|
|
|
|
// [New] Manual profile resolution to support query-param role mocking
|
|
// This is needed because browsers cannot send custom headers for direct downloads
|
|
mockRole := c.Query("x-test-role")
|
|
appEnv := strings.ToLower(os.Getenv("APP_ENV"))
|
|
isDev := appEnv == "dev" || appEnv == "development" || appEnv == ""
|
|
|
|
if isDev && mockRole != "" {
|
|
slog.Info("🔑 [AUTH] Using mock role from query for export", "role", mockRole)
|
|
requesterRole = mockRole
|
|
// In dev mocking, we might not have a full profile, but we need to know the manageable tenants if it's a tenant_admin
|
|
if requesterRole == domain.RoleTenantAdmin {
|
|
// Try to get actual profile if possible to get manageableTenants
|
|
p, _ := c.Locals("user_profile").(*domain.UserProfileResponse)
|
|
if p != nil {
|
|
profile = p
|
|
}
|
|
}
|
|
} else {
|
|
// Use real profile from middleware
|
|
p, ok := c.Locals("user_profile").(*domain.UserProfileResponse)
|
|
if !ok || p == nil {
|
|
return errorJSON(c, fiber.StatusUnauthorized, "invalid session (trace:export_auth)")
|
|
}
|
|
profile = p
|
|
requesterRole = profile.Role
|
|
}
|
|
|
|
// [New] Access Control: only admin roles can export
|
|
if requesterRole != domain.RoleSuperAdmin && requesterRole != domain.RoleTenantAdmin {
|
|
return errorJSON(c, fiber.StatusForbidden, "forbidden: insufficient permissions for export")
|
|
}
|
|
|
|
if profile != nil && requesterRole == domain.RoleTenantAdmin {
|
|
for _, t := range profile.ManageableTenants {
|
|
manageableSlugs = append(manageableSlugs, strings.ToLower(t.Slug))
|
|
}
|
|
if profile.CompanyCode != "" {
|
|
manageableSlugs = append(manageableSlugs, strings.ToLower(profile.CompanyCode))
|
|
}
|
|
}
|
|
|
|
// 1. Fetch Users using Repo for efficiency
|
|
// repo.List expects (ctx, offset, limit, search, companyCode)
|
|
users, _, err := h.UserRepo.List(c.Context(), 0, 10000, search, companyCode)
|
|
if err != nil {
|
|
return errorJSON(c, fiber.StatusInternalServerError, "failed to fetch users for export")
|
|
}
|
|
|
|
// 2. Filter by manageable tenants if tenant_admin
|
|
var filtered []domain.User
|
|
if requesterRole == domain.RoleTenantAdmin {
|
|
slugMap := make(map[string]bool)
|
|
for _, s := range manageableSlugs {
|
|
slugMap[s] = true
|
|
}
|
|
for _, u := range users {
|
|
if slugMap[strings.ToLower(u.CompanyCode)] {
|
|
filtered = append(filtered, u)
|
|
}
|
|
}
|
|
} else {
|
|
filtered = users
|
|
}
|
|
|
|
// 3. Set CSV Headers
|
|
c.Set("Content-Type", "text/csv; charset=utf-8")
|
|
c.Set("Content-Disposition", "attachment; filename=users_export_"+time.Now().Format("20060102")+".csv")
|
|
|
|
// [New] Write UTF-8 BOM for Excel compatibility
|
|
_, _ = c.Write([]byte{0xEF, 0xBB, 0xBF})
|
|
|
|
writer := csv.NewWriter(c)
|
|
defer writer.Flush()
|
|
|
|
// Header row
|
|
header := []string{"ID", "Email", "Name", "Role", "Status", "Tenant", "Department", "Position", "JobTitle", "CreatedAt"}
|
|
|
|
// Collect all possible metadata keys for dynamic columns
|
|
metaKeysMap := make(map[string]bool)
|
|
for _, u := range filtered {
|
|
for k := range u.Metadata {
|
|
metaKeysMap[k] = true
|
|
}
|
|
}
|
|
var metaKeys []string
|
|
for k := range metaKeysMap {
|
|
metaKeys = append(metaKeys, k)
|
|
header = append(header, "Meta:"+k)
|
|
}
|
|
|
|
if err := writer.Write(header); err != nil {
|
|
return err
|
|
}
|
|
|
|
// Data rows
|
|
for _, u := range filtered {
|
|
row := []string{
|
|
u.ID,
|
|
u.Email,
|
|
u.Name,
|
|
u.Role,
|
|
u.Status,
|
|
u.CompanyCode,
|
|
u.Department,
|
|
u.Position,
|
|
u.JobTitle,
|
|
u.CreatedAt.Format(time.RFC3339),
|
|
}
|
|
// Append metadata values in order
|
|
for _, k := range metaKeys {
|
|
val := ""
|
|
if v, ok := u.Metadata[k]; ok {
|
|
val = fmt.Sprintf("%v", v)
|
|
}
|
|
row = append(row, val)
|
|
}
|
|
if err := writer.Write(row); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func (h *UserHandler) BulkUpdateUsers(c *fiber.Ctx) error {
|
|
var req struct {
|
|
UserIDs []string `json:"userIds"`
|
|
Status *string `json:"status"`
|
|
Role *string `json:"role"`
|
|
CompanyCode *string `json:"companyCode"`
|
|
Department *string `json:"department"`
|
|
}
|
|
if err := c.BodyParser(&req); err != nil {
|
|
return errorJSON(c, fiber.StatusBadRequest, "invalid request body")
|
|
}
|
|
|
|
if len(req.UserIDs) == 0 {
|
|
return errorJSON(c, fiber.StatusBadRequest, "no user IDs provided")
|
|
}
|
|
|
|
requester, _ := c.Locals("user_profile").(*domain.UserProfileResponse)
|
|
if requester == nil {
|
|
return errorJSON(c, fiber.StatusUnauthorized, "unauthorized")
|
|
}
|
|
|
|
// [New] Pre-fetch tenant cache if companyCode is being changed
|
|
type tenantCacheItem struct {
|
|
ID string
|
|
Schema []interface{}
|
|
}
|
|
tenantCache := make(map[string]tenantCacheItem)
|
|
|
|
manageableSlugs := make(map[string]bool)
|
|
if requester.Role == domain.RoleTenantAdmin {
|
|
for _, t := range requester.ManageableTenants {
|
|
manageableSlugs[strings.ToLower(t.Slug)] = true
|
|
}
|
|
if requester.CompanyCode != "" {
|
|
manageableSlugs[strings.ToLower(requester.CompanyCode)] = true
|
|
}
|
|
}
|
|
|
|
results := make([]map[string]any, 0, len(req.UserIDs))
|
|
|
|
for _, id := range req.UserIDs {
|
|
identity, err := h.KratosAdmin.GetIdentity(c.Context(), id)
|
|
if err != nil {
|
|
results = append(results, map[string]any{"id": id, "success": false, "message": "user not found"})
|
|
continue
|
|
}
|
|
|
|
// Authorization check
|
|
userComp := strings.ToLower(extractTraitString(identity.Traits, "companyCode"))
|
|
if requester.Role == domain.RoleTenantAdmin {
|
|
if !manageableSlugs[userComp] {
|
|
results = append(results, map[string]any{"id": id, "success": false, "message": "forbidden: user belongs to another tenant"})
|
|
continue
|
|
}
|
|
// If changing companyCode, must be to a manageable one
|
|
if req.CompanyCode != nil {
|
|
if !manageableSlugs[strings.ToLower(*req.CompanyCode)] {
|
|
results = append(results, map[string]any{"id": id, "success": false, "message": "forbidden: target tenant not manageable"})
|
|
continue
|
|
}
|
|
}
|
|
}
|
|
|
|
// Prepare updates
|
|
traits := identity.Traits
|
|
if req.Role != nil {
|
|
traits["role"] = *req.Role
|
|
}
|
|
if req.CompanyCode != nil {
|
|
traits["companyCode"] = *req.CompanyCode
|
|
|
|
// Resolve and update tenant_id in traits if changed
|
|
if tItem, exists := tenantCache[*req.CompanyCode]; exists {
|
|
traits["tenant_id"] = tItem.ID
|
|
} else if h.TenantService != nil {
|
|
tenant, err := h.TenantService.GetTenantBySlug(c.Context(), *req.CompanyCode)
|
|
if err == nil && tenant != nil {
|
|
tItem.ID = tenant.ID
|
|
tenantCache[*req.CompanyCode] = tItem
|
|
traits["tenant_id"] = tenant.ID
|
|
}
|
|
}
|
|
}
|
|
if req.Department != nil {
|
|
traits["department"] = *req.Department
|
|
}
|
|
|
|
state := identity.State
|
|
if req.Status != nil {
|
|
if *req.Status == "active" {
|
|
state = "active"
|
|
} else {
|
|
state = "inactive"
|
|
}
|
|
}
|
|
|
|
_, err = h.KratosAdmin.UpdateIdentity(c.Context(), id, traits, state)
|
|
if err != nil {
|
|
results = append(results, map[string]any{"id": id, "success": false, "message": err.Error()})
|
|
continue
|
|
}
|
|
|
|
// Sync to local DB
|
|
if h.UserRepo != nil {
|
|
localUser := h.mapToLocalUser(*identity)
|
|
oldRole := extractTraitString(identity.Traits, "grade")
|
|
oldTenantID := extractTraitString(identity.Traits, "tenant_id")
|
|
|
|
if req.Role != nil {
|
|
localUser.Role = *req.Role
|
|
}
|
|
if req.Status != nil {
|
|
localUser.Status = *req.Status
|
|
}
|
|
if req.CompanyCode != nil {
|
|
localUser.CompanyCode = *req.CompanyCode
|
|
}
|
|
if req.Department != nil {
|
|
localUser.Department = *req.Department
|
|
}
|
|
|
|
// Resolve TenantID if changing companyCode
|
|
if req.CompanyCode != nil && h.TenantService != nil {
|
|
if tenant, err := h.TenantService.GetTenantBySlug(c.Context(), *req.CompanyCode); err == nil && tenant != nil {
|
|
localUser.TenantID = &tenant.ID
|
|
}
|
|
}
|
|
|
|
if localUser.LoginID == "" {
|
|
localUser.LoginID = localUser.ID
|
|
}
|
|
|
|
_ = h.UserRepo.Update(c.Context(), localUser)
|
|
|
|
// [Keto Sync]
|
|
if h.KetoOutboxRepo != nil {
|
|
h.syncKetoRole(c.Context(), localUser.ID,
|
|
localUser.Role, oldRole, oldTenantID, localUser.TenantID)
|
|
}
|
|
}
|
|
|
|
results = append(results, map[string]any{"id": id, "success": true})
|
|
}
|
|
|
|
return c.JSON(fiber.Map{"results": results})
|
|
}
|
|
|
|
func (h *UserHandler) BulkDeleteUsers(c *fiber.Ctx) error {
|
|
var req struct {
|
|
UserIDs []string `json:"userIds"`
|
|
}
|
|
if err := c.BodyParser(&req); err != nil {
|
|
return errorJSON(c, fiber.StatusBadRequest, "invalid request body")
|
|
}
|
|
|
|
if len(req.UserIDs) == 0 {
|
|
return errorJSON(c, fiber.StatusBadRequest, "no user IDs provided")
|
|
}
|
|
|
|
requester, _ := c.Locals("user_profile").(*domain.UserProfileResponse)
|
|
if requester == nil {
|
|
return errorJSON(c, fiber.StatusUnauthorized, "unauthorized")
|
|
}
|
|
|
|
manageableSlugs := make(map[string]bool)
|
|
if requester.Role == domain.RoleTenantAdmin {
|
|
for _, t := range requester.ManageableTenants {
|
|
manageableSlugs[strings.ToLower(t.Slug)] = true
|
|
}
|
|
if requester.CompanyCode != "" {
|
|
manageableSlugs[strings.ToLower(requester.CompanyCode)] = true
|
|
}
|
|
}
|
|
|
|
results := make([]map[string]any, 0, len(req.UserIDs))
|
|
|
|
for _, id := range req.UserIDs {
|
|
identity, err := h.KratosAdmin.GetIdentity(c.Context(), id)
|
|
if err != nil {
|
|
results = append(results, map[string]any{"id": id, "success": false, "message": "user not found"})
|
|
continue
|
|
}
|
|
|
|
// Authorization check
|
|
if requester.Role == domain.RoleTenantAdmin {
|
|
userComp := strings.ToLower(extractTraitString(identity.Traits, "companyCode"))
|
|
if !manageableSlugs[userComp] {
|
|
results = append(results, map[string]any{"id": id, "success": false, "message": "forbidden"})
|
|
continue
|
|
}
|
|
}
|
|
|
|
err = h.KratosAdmin.DeleteIdentity(c.Context(), id)
|
|
if err != nil {
|
|
results = append(results, map[string]any{"id": id, "success": false, "message": err.Error()})
|
|
continue
|
|
}
|
|
|
|
// Local DB Sync
|
|
if h.UserRepo != nil {
|
|
_ = h.UserRepo.Delete(c.Context(), id)
|
|
}
|
|
|
|
results = append(results, map[string]any{"id": id, "success": true})
|
|
}
|
|
|
|
return c.JSON(fiber.Map{"results": results})
|
|
}
|
|
|
|
func (h *UserHandler) UpdateUser(c *fiber.Ctx) error {
|
|
if h.KratosAdmin == nil {
|
|
return errorJSON(c, fiber.StatusServiceUnavailable, "identity provider not available")
|
|
}
|
|
|
|
userID := strings.TrimSpace(c.Params("id"))
|
|
if userID == "" {
|
|
return errorJSON(c, fiber.StatusBadRequest, "user id is required")
|
|
}
|
|
|
|
identity, err := h.KratosAdmin.GetIdentity(c.Context(), userID)
|
|
if err != nil {
|
|
return errorJSON(c, fiber.StatusInternalServerError, err.Error())
|
|
}
|
|
if identity == nil {
|
|
return errorJSON(c, fiber.StatusNotFound, "user not found")
|
|
}
|
|
|
|
// Capture current local state for transition comparison
|
|
var oldRole string
|
|
var oldTenantID string
|
|
var oldDepartment string
|
|
if h.UserRepo != nil {
|
|
if local, err := h.UserRepo.FindByID(c.Context(), userID); err == nil && local != nil {
|
|
oldRole = local.Role
|
|
oldDepartment = local.Department
|
|
if local.TenantID != nil {
|
|
oldTenantID = *local.TenantID
|
|
}
|
|
}
|
|
}
|
|
|
|
// [New] Check access scope
|
|
requester, _ := c.Locals("user_profile").(*domain.UserProfileResponse)
|
|
if requester != nil && domain.NormalizeRole(requester.Role) == domain.RoleTenantAdmin {
|
|
compCode := extractTraitString(identity.Traits, "companyCode")
|
|
if requester.CompanyCode == "" || compCode != requester.CompanyCode {
|
|
return errorJSON(c, fiber.StatusForbidden, "forbidden: cannot update user in another tenant")
|
|
}
|
|
}
|
|
|
|
var req struct {
|
|
LoginID *string `json:"loginId"`
|
|
Password *string `json:"password"`
|
|
Name *string `json:"name"`
|
|
Phone *string `json:"phone"`
|
|
Role *string `json:"role"`
|
|
Status *string `json:"status"`
|
|
CompanyCode *string `json:"companyCode"`
|
|
Department *string `json:"department"`
|
|
Metadata map[string]any `json:"metadata"`
|
|
}
|
|
if err := c.BodyParser(&req); err != nil {
|
|
return errorJSON(c, fiber.StatusBadRequest, "invalid request body")
|
|
}
|
|
|
|
// [New] Tenant Admin restriction: Cannot change companyCode
|
|
if requester != nil && domain.NormalizeRole(requester.Role) == domain.RoleTenantAdmin {
|
|
if req.CompanyCode != nil && *req.CompanyCode != requester.CompanyCode {
|
|
return errorJSON(c, fiber.StatusForbidden, "forbidden: tenant admins cannot change user's tenant")
|
|
}
|
|
}
|
|
|
|
// [Validation] Based on Tenant Schema (Multi-tenant aware)
|
|
isAdmin := requester != nil && (requester.Role == domain.RoleSuperAdmin || requester.Role == domain.RoleTenantAdmin)
|
|
|
|
// If metadata is namespaced (key is tenant ID), validate each namespace
|
|
// If it's flat, validate using schemaCompCode
|
|
for key, val := range req.Metadata {
|
|
// Basic check if key looks like a UUID (tenant ID)
|
|
if len(key) >= 32 {
|
|
// Namespaced metadata
|
|
if h.TenantService != nil {
|
|
tenant, err := h.TenantService.GetTenant(c.Context(), key)
|
|
if err == nil && tenant != nil {
|
|
if schema, ok := tenant.Config["userSchema"].([]interface{}); ok {
|
|
if subMeta, ok := val.(map[string]any); ok {
|
|
if err := h.validateMetadataWithAuth(subMeta, schema, isAdmin, false); err != nil {
|
|
return errorJSON(c, fiber.StatusBadRequest, "metadata validation failed for tenant "+tenant.Name+": "+err.Error())
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
} else {
|
|
// Legacy/Flat metadata - validate using primary tenant schema
|
|
schemaCompCode := extractTraitString(identity.Traits, "companyCode")
|
|
if req.CompanyCode != nil {
|
|
schemaCompCode = *req.CompanyCode
|
|
}
|
|
if schemaCompCode != "" && h.TenantService != nil {
|
|
tenant, err := h.TenantService.GetTenantBySlug(c.Context(), schemaCompCode)
|
|
if err == nil && tenant != nil {
|
|
if schema, ok := tenant.Config["userSchema"].([]interface{}); ok {
|
|
// For flat metadata, we validate the whole req.Metadata against this schema
|
|
if err := h.validateMetadataWithAuth(req.Metadata, schema, isAdmin, false); err != nil {
|
|
return errorJSON(c, fiber.StatusBadRequest, "metadata validation failed: "+err.Error())
|
|
}
|
|
}
|
|
}
|
|
}
|
|
break // Only need to check flat metadata once
|
|
}
|
|
}
|
|
|
|
traits := identity.Traits
|
|
if traits == nil {
|
|
traits = map[string]interface{}{}
|
|
}
|
|
if req.Name != nil {
|
|
traits["name"] = strings.TrimSpace(*req.Name)
|
|
}
|
|
if req.Phone != nil {
|
|
phone := normalizePhoneNumber(strings.TrimSpace(*req.Phone))
|
|
if phone == "" {
|
|
delete(traits, "phone_number")
|
|
} else {
|
|
traits["phone_number"] = phone
|
|
}
|
|
}
|
|
if req.CompanyCode != nil {
|
|
code := strings.TrimSpace(*req.CompanyCode)
|
|
traits["companyCode"] = code
|
|
// Resolve TenantID for Kratos Trait
|
|
if h.TenantService != nil && code != "" {
|
|
if tenant, err := h.TenantService.GetTenantBySlug(c.Context(), code); err == nil && tenant != nil {
|
|
traits["tenant_id"] = tenant.ID
|
|
}
|
|
}
|
|
}
|
|
if req.Department != nil {
|
|
traits["department"] = strings.TrimSpace(*req.Department)
|
|
}
|
|
if req.Role != nil {
|
|
role := domain.NormalizeRole(*req.Role)
|
|
if role == "" {
|
|
role = domain.RoleUser
|
|
}
|
|
traits["grade"] = role
|
|
traits["role"] = role
|
|
}
|
|
|
|
// [Override with explicit LoginID if provided]
|
|
// This is done FIRST so that if a custom loginIdField is configured in the tenant,
|
|
// the metadata sync below will override this explicit value, preventing the UI's
|
|
// pre-filled explicit loginId from clobbering the updated custom field.
|
|
if req.LoginID != nil && *req.LoginID != "" {
|
|
traits["id"] = *req.LoginID
|
|
}
|
|
|
|
// [Namespaced Metadata Sync]
|
|
coreTraits := map[string]bool{
|
|
"email": true, "name": true, "phone_number": true,
|
|
"grade": true, "companyCode": true, "department": true,
|
|
"affiliationType": true, "role": true, "tenant_id": true,
|
|
"id": true,
|
|
}
|
|
|
|
// For namespaced metadata, we don't delete everything, we merge.
|
|
for k, v := range req.Metadata {
|
|
if !coreTraits[k] {
|
|
// Ensure we are merging maps (tenant namespaces) correctly, not overwriting with slices
|
|
if incomingMap, ok := v.(map[string]any); ok {
|
|
if existingMap, ok := traits[k].(map[string]interface{}); ok {
|
|
for subK, subV := range incomingMap {
|
|
existingMap[subK] = subV
|
|
}
|
|
traits[k] = existingMap
|
|
} else {
|
|
traits[k] = incomingMap // New namespace
|
|
}
|
|
} else {
|
|
traits[k] = v // Fallback for flat metadata
|
|
}
|
|
}
|
|
}
|
|
|
|
// [LoginID Sync based on Tenant Settings]
|
|
// Perform sync AFTER metadata merge to ensure traits contains current values
|
|
syncCompCode := extractTraitString(traits, "companyCode")
|
|
if syncCompCode != "" && h.TenantService != nil {
|
|
if tenant, err := h.TenantService.GetTenantBySlug(c.Context(), syncCompCode); err == nil && tenant != nil {
|
|
if loginIdField, ok := tenant.Config["loginIdField"].(string); ok && loginIdField != "" {
|
|
syncLoginID(traits, req.Metadata, tenant.ID, loginIdField)
|
|
}
|
|
}
|
|
}
|
|
|
|
finalLoginID := extractTraitString(traits, "id")
|
|
userEmail := extractTraitString(traits, "email")
|
|
userPhone := extractTraitString(traits, "phone")
|
|
if err := domain.ValidateLoginID(finalLoginID, userEmail, userPhone); err != nil {
|
|
return errorJSON(c, fiber.StatusBadRequest, err.Error())
|
|
}
|
|
|
|
state := normalizeKratosState(req.Status)
|
|
|
|
slog.Info("[UpdateUser] Calling Kratos UpdateIdentity", "userID", userID, "traits", traits, "state", state)
|
|
|
|
updated, err := h.KratosAdmin.UpdateIdentity(c.Context(), userID, traits, state)
|
|
if err != nil {
|
|
return errorJSON(c, fiber.StatusInternalServerError, err.Error())
|
|
}
|
|
|
|
// [New] Local DB Sync - Sync synchronously to ensure immediate consistency for the caller
|
|
if h.UserRepo != nil {
|
|
updatedLocalUser := h.mapToLocalUser(*updated)
|
|
|
|
if updatedLocalUser.LoginID == "" {
|
|
updatedLocalUser.LoginID = updatedLocalUser.ID
|
|
}
|
|
|
|
ctx := context.Background() // Use request context if appropriate, but sync must finish
|
|
if err := h.UserRepo.Update(ctx, updatedLocalUser); err != nil {
|
|
slog.Error("[UserHandler] Failed to sync updated user to local DB", "userID", updatedLocalUser.ID, "error", err)
|
|
}
|
|
|
|
// [Keto Sync] asynchronously as it's less critical for immediate UI count
|
|
go func() {
|
|
bgCtx := context.Background()
|
|
h.syncKetoRole(bgCtx, updatedLocalUser.ID,
|
|
extractTraitString(updated.Traits, "grade"), oldRole, oldTenantID, updatedLocalUser.TenantID)
|
|
|
|
// Try to automatically sync UserGroup membership based on Department
|
|
if h.UserGroupRepo != nil && h.KetoOutboxRepo != nil {
|
|
// 1. Remove from old group if department or tenant changed
|
|
if oldTenantID != "" && oldDepartment != "" && (oldTenantID != extractTraitString(updated.Traits, "tenant_id") || oldDepartment != updatedLocalUser.Department) {
|
|
if oldGroups, err := h.UserGroupRepo.ListByTenantID(bgCtx, oldTenantID); err == nil {
|
|
for _, g := range oldGroups {
|
|
if strings.EqualFold(g.Name, oldDepartment) {
|
|
_ = h.KetoOutboxRepo.Create(bgCtx, &domain.KetoOutbox{
|
|
Namespace: "Tenant",
|
|
Object: g.ID,
|
|
Relation: "members",
|
|
Subject: "User:" + updatedLocalUser.ID,
|
|
Action: domain.KetoOutboxActionDelete,
|
|
})
|
|
break
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
// 2. Add to new group
|
|
if updatedLocalUser.TenantID != nil && updatedLocalUser.Department != "" {
|
|
if groups, err := h.UserGroupRepo.ListByTenantID(bgCtx, *updatedLocalUser.TenantID); err == nil {
|
|
for _, g := range groups {
|
|
if strings.EqualFold(g.Name, updatedLocalUser.Department) {
|
|
_ = h.KetoOutboxRepo.Create(bgCtx, &domain.KetoOutbox{
|
|
Namespace: "Tenant",
|
|
Object: g.ID,
|
|
Relation: "members",
|
|
Subject: "User:" + updatedLocalUser.ID,
|
|
Action: domain.KetoOutboxActionCreate,
|
|
})
|
|
break
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
// [Self-Healing] If the UI explicitly assigned the tenant, force a Keto relation sync.
|
|
// This fixes issues where local DB had the tenant, but Keto failed to create the relation previously.
|
|
if req.CompanyCode != nil && h.KetoOutboxRepo != nil && updatedLocalUser.TenantID != nil {
|
|
_ = h.KetoOutboxRepo.Create(bgCtx, &domain.KetoOutbox{
|
|
Namespace: "Tenant",
|
|
Object: *updatedLocalUser.TenantID,
|
|
Relation: "members",
|
|
Subject: "User:" + updatedLocalUser.ID,
|
|
Action: domain.KetoOutboxActionCreate,
|
|
})
|
|
}
|
|
}()
|
|
}
|
|
|
|
if req.Password != nil && *req.Password != "" {
|
|
if err := h.KratosAdmin.UpdateIdentityPassword(c.Context(), userID, *req.Password); err != nil {
|
|
return errorJSON(c, fiber.StatusInternalServerError, err.Error())
|
|
}
|
|
}
|
|
|
|
return c.JSON(h.mapIdentitySummary(c.Context(), *updated))
|
|
}
|
|
|
|
func (h *UserHandler) DeleteUser(c *fiber.Ctx) error {
|
|
if h.KratosAdmin == nil {
|
|
return errorJSON(c, fiber.StatusServiceUnavailable, "identity provider not available")
|
|
}
|
|
|
|
userID := strings.TrimSpace(c.Params("id"))
|
|
if userID == "" {
|
|
return errorJSON(c, fiber.StatusBadRequest, "user id is required")
|
|
}
|
|
|
|
// [New] Check access scope before deletion
|
|
requester, _ := c.Locals("user_profile").(*domain.UserProfileResponse)
|
|
if requester != nil && domain.NormalizeRole(requester.Role) == domain.RoleTenantAdmin {
|
|
identity, err := h.KratosAdmin.GetIdentity(c.Context(), userID)
|
|
if err == nil && identity != nil {
|
|
compCode := extractTraitString(identity.Traits, "companyCode")
|
|
if requester.CompanyCode == "" || compCode != requester.CompanyCode {
|
|
return errorJSON(c, fiber.StatusForbidden, "forbidden: cannot delete user in another tenant")
|
|
}
|
|
}
|
|
}
|
|
|
|
if err := h.KratosAdmin.DeleteIdentity(c.Context(), userID); err != nil {
|
|
return errorJSON(c, fiber.StatusInternalServerError, err.Error())
|
|
}
|
|
|
|
// [Keto] Cleanup relations via Outbox
|
|
if h.KetoOutboxRepo != nil {
|
|
ctx := context.Background()
|
|
_ = h.KetoOutboxRepo.Create(ctx, &domain.KetoOutbox{
|
|
Namespace: "System",
|
|
Object: "global",
|
|
Relation: "super_admins",
|
|
Subject: "User:" + userID,
|
|
Action: domain.KetoOutboxActionDelete,
|
|
})
|
|
// Additional cleanup for tenants could be added here if we keep track of user's current tenants
|
|
}
|
|
|
|
return c.SendStatus(fiber.StatusNoContent)
|
|
}
|
|
|
|
func (h *UserHandler) mapIdentitySummary(ctx context.Context, identity service.KratosIdentity) userSummary {
|
|
traits := identity.Traits
|
|
role := extractTraitString(traits, "grade")
|
|
if role == "" {
|
|
role = extractTraitString(traits, "role")
|
|
}
|
|
role = domain.NormalizeRole(role)
|
|
if role == "" {
|
|
role = domain.RoleUser
|
|
}
|
|
|
|
compCode := extractTraitString(traits, "companyCode")
|
|
slog.Debug("Mapping identity", "email", extractTraitString(traits, "email"), "compCode", compCode)
|
|
summary := userSummary{
|
|
ID: identity.ID,
|
|
Email: extractTraitString(traits, "email"),
|
|
Name: extractTraitString(traits, "name"),
|
|
Phone: extractTraitString(traits, "phone_number"),
|
|
Role: role,
|
|
Status: normalizeStatus(identity.State),
|
|
CompanyCode: compCode,
|
|
Department: extractTraitString(traits, "department"),
|
|
Metadata: make(domain.JSONMap),
|
|
CreatedAt: formatTime(identity.CreatedAt),
|
|
UpdatedAt: formatTime(identity.UpdatedAt),
|
|
}
|
|
|
|
// [New] Fetch all manageable tenants (for Multi-tenancy support)
|
|
if h.TenantService != nil {
|
|
if joined, err := h.TenantService.ListManageableTenants(ctx, identity.ID); err == nil {
|
|
summary.JoinedTenants = joined
|
|
}
|
|
}
|
|
|
|
// [Namespaced Metadata] Handling
|
|
// We assume core traits are at the top level.
|
|
// For other keys, if they are UUIDs (tenant IDs), we treat them as namespaced metadata.
|
|
// Otherwise, we put them in a "legacy" or "flat" bucket if needed, but for now let's keep them in summary.Metadata
|
|
coreTraits := map[string]bool{
|
|
"email": true, "name": true, "phone_number": true,
|
|
"grade": true, "companyCode": true, "department": true,
|
|
"affiliationType": true, "role": true, "tenant_id": true,
|
|
}
|
|
|
|
for k, v := range traits {
|
|
if coreTraits[k] {
|
|
continue
|
|
}
|
|
// If the key is a tenant ID (uuid-like), it's namespaced metadata
|
|
// If not, it's flat metadata (for backward compatibility)
|
|
summary.Metadata[k] = v
|
|
}
|
|
|
|
if compCode != "" && h.TenantService != nil {
|
|
if tenant, err := h.TenantService.GetTenantBySlug(ctx, compCode); err == nil && tenant != nil {
|
|
summary.Tenant = tenant
|
|
}
|
|
}
|
|
|
|
return summary
|
|
}
|
|
|
|
func (h *UserHandler) normalizePhoneNumber(phone string) string {
|
|
return normalizePhoneNumber(phone)
|
|
}
|
|
|
|
func (h *UserHandler) mapToLocalUser(identity service.KratosIdentity) *domain.User {
|
|
traits := identity.Traits
|
|
role := extractTraitString(traits, "grade")
|
|
if role == "" {
|
|
role = extractTraitString(traits, "role")
|
|
}
|
|
role = domain.NormalizeRole(role)
|
|
if role == "" {
|
|
role = domain.RoleUser
|
|
}
|
|
compCode := extractTraitString(traits, "companyCode")
|
|
if compCode == "" {
|
|
compCode = extractTraitString(traits, "company_code")
|
|
}
|
|
|
|
loginID := extractTraitString(traits, "id")
|
|
if loginID == "" {
|
|
// Fallback to UUID to prevent unique constraint violations on idx_tenant_login_id
|
|
// for users that use email/phone exclusively and don't have a specific loginId trait.
|
|
loginID = identity.ID
|
|
}
|
|
|
|
user := &domain.User{
|
|
ID: identity.ID,
|
|
Email: extractTraitString(traits, "email"),
|
|
LoginID: loginID,
|
|
Name: extractTraitString(traits, "name"),
|
|
Phone: extractTraitString(traits, "phone_number"),
|
|
Role: role,
|
|
Status: normalizeStatus(identity.State),
|
|
CompanyCode: compCode,
|
|
Department: extractTraitString(traits, "department"),
|
|
AffiliationType: extractTraitString(traits, "affiliationType"),
|
|
CreatedAt: identity.CreatedAt,
|
|
UpdatedAt: identity.UpdatedAt,
|
|
}
|
|
|
|
// 1. Try to get tenant_id directly from Kratos traits first (Fastest & most reliable)
|
|
tID := extractTraitString(traits, "tenant_id")
|
|
if tID != "" {
|
|
user.TenantID = &tID
|
|
}
|
|
|
|
// 2. Fallback to slug lookup only if tenant_id trait is missing
|
|
if (user.TenantID == nil || *user.TenantID == "") && compCode != "" && h.TenantService != nil {
|
|
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
|
defer cancel()
|
|
if tenant, err := h.TenantService.GetTenantBySlug(ctx, compCode); err == nil && tenant != nil {
|
|
user.TenantID = &tenant.ID
|
|
}
|
|
}
|
|
|
|
// Metadata handling (exclude core fields)
|
|
user.Metadata = make(domain.JSONMap)
|
|
coreTraits := map[string]bool{
|
|
"email": true, "name": true, "phone_number": true,
|
|
"grade": true, "companyCode": true, "department": true,
|
|
"affiliationType": true, "role": true, "tenant_id": true, "company_code": true,
|
|
}
|
|
for k, v := range traits {
|
|
if !coreTraits[k] {
|
|
user.Metadata[k] = v
|
|
}
|
|
}
|
|
|
|
return user
|
|
}
|
|
|
|
func (h *UserHandler) syncKetoRole(ctx context.Context, userID, newRole, oldRole, oldTenantID string, newTenantID *string) {
|
|
newRole = domain.NormalizeRole(newRole)
|
|
oldRole = domain.NormalizeRole(oldRole)
|
|
|
|
newTID := ""
|
|
if newTenantID != nil {
|
|
newTID = *newTenantID
|
|
}
|
|
|
|
if h.KetoOutboxRepo == nil {
|
|
return
|
|
}
|
|
|
|
if oldRole == newRole && oldTenantID == newTID {
|
|
return // Nothing changed
|
|
}
|
|
|
|
// 1. Handle Role Changes
|
|
if oldRole == domain.RoleSuperAdmin {
|
|
// Only remove super_admin if the role actually changed (tenant change doesn't matter for global roles)
|
|
if oldRole != newRole {
|
|
_ = h.KetoOutboxRepo.Create(ctx, &domain.KetoOutbox{
|
|
Namespace: "System",
|
|
Object: "global",
|
|
Relation: "super_admins",
|
|
Subject: "User:" + userID,
|
|
Action: domain.KetoOutboxActionDelete,
|
|
})
|
|
}
|
|
} else if oldRole == domain.RoleTenantAdmin && oldTenantID != "" {
|
|
_ = h.KetoOutboxRepo.Create(ctx, &domain.KetoOutbox{
|
|
Namespace: "Tenant",
|
|
Object: oldTenantID,
|
|
Relation: "admins",
|
|
Subject: "User:" + userID,
|
|
Action: domain.KetoOutboxActionDelete,
|
|
})
|
|
}
|
|
|
|
// Add new roles
|
|
if newRole == domain.RoleSuperAdmin {
|
|
if oldRole != newRole {
|
|
_ = h.KetoOutboxRepo.Create(ctx, &domain.KetoOutbox{
|
|
Namespace: "System",
|
|
Object: "global",
|
|
Relation: "super_admins",
|
|
Subject: "User:" + userID,
|
|
Action: domain.KetoOutboxActionCreate,
|
|
})
|
|
}
|
|
} else if newRole == domain.RoleTenantAdmin && newTID != "" {
|
|
_ = h.KetoOutboxRepo.Create(ctx, &domain.KetoOutbox{
|
|
Namespace: "Tenant",
|
|
Object: newTID,
|
|
Relation: "admins",
|
|
Subject: "User:" + userID,
|
|
Action: domain.KetoOutboxActionCreate,
|
|
})
|
|
}
|
|
|
|
// 2. Handle Tenant Membership (for count)
|
|
if oldTenantID != newTID {
|
|
// Remove from old tenant
|
|
if oldTenantID != "" {
|
|
_ = h.KetoOutboxRepo.Create(ctx, &domain.KetoOutbox{
|
|
Namespace: "Tenant",
|
|
Object: oldTenantID,
|
|
Relation: "members",
|
|
Subject: "User:" + userID,
|
|
Action: domain.KetoOutboxActionDelete,
|
|
})
|
|
}
|
|
// Add to new tenant
|
|
if newTID != "" {
|
|
_ = h.KetoOutboxRepo.Create(ctx, &domain.KetoOutbox{
|
|
Namespace: "Tenant",
|
|
Object: newTID,
|
|
Relation: "members",
|
|
Subject: "User:" + userID,
|
|
Action: domain.KetoOutboxActionCreate,
|
|
})
|
|
}
|
|
}
|
|
}
|
|
|
|
func extractTraitString(traits map[string]interface{}, key string) string {
|
|
if traits == nil {
|
|
return ""
|
|
}
|
|
if raw, ok := traits[key]; ok {
|
|
if value, ok := raw.(string); ok {
|
|
return value
|
|
}
|
|
}
|
|
return ""
|
|
}
|
|
|
|
// syncLoginID ensures that the 'id' trait (used as Kratos identifier) is in sync with the configured custom field.
|
|
func syncLoginID(traits map[string]interface{}, metadata map[string]any, tenantID string, loginIDField string) {
|
|
if loginIDField == "" || loginIDField == "id" {
|
|
return
|
|
}
|
|
|
|
var loginID string
|
|
|
|
// 1. Check incoming metadata (flat)
|
|
if val, ok := metadata[loginIDField].(string); ok && val != "" {
|
|
loginID = val
|
|
}
|
|
|
|
// 2. Check incoming metadata (namespaced by tenant ID)
|
|
if loginID == "" && tenantID != "" {
|
|
if namespaced, ok := metadata[tenantID].(map[string]any); ok {
|
|
if val, ok := namespaced[loginIDField].(string); ok && val != "" {
|
|
loginID = val
|
|
}
|
|
} else if namespaced, ok := metadata[tenantID].(map[string]interface{}); ok {
|
|
if val, ok := namespaced[loginIDField].(string); ok && val != "" {
|
|
loginID = val
|
|
}
|
|
}
|
|
}
|
|
|
|
// 3. Check merged traits (which includes existing metadata)
|
|
if loginID == "" {
|
|
// Existing trait (flat)
|
|
if val, ok := traits[loginIDField].(string); ok && val != "" {
|
|
loginID = val
|
|
} else if tenantID != "" {
|
|
// Existing trait (namespaced)
|
|
if namespaced, ok := traits[tenantID].(map[string]interface{}); ok {
|
|
if val, ok := namespaced[loginIDField].(string); ok && val != "" {
|
|
loginID = val
|
|
}
|
|
} else if namespaced, ok := traits[tenantID].(map[string]any); ok {
|
|
if val, ok := namespaced[loginIDField].(string); ok && val != "" {
|
|
loginID = val
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
if loginID != "" {
|
|
slog.Info("Syncing LoginID from custom field", "field", loginIDField, "value", loginID, "tenantID", tenantID)
|
|
traits["id"] = loginID
|
|
}
|
|
}
|
|
|
|
func formatTime(value time.Time) string {
|
|
if value.IsZero() {
|
|
return ""
|
|
}
|
|
return value.Format(time.RFC3339)
|
|
}
|
|
|
|
func normalizeStatus(state string) string {
|
|
state = strings.ToLower(strings.TrimSpace(state))
|
|
if state == "inactive" || state == "blocked" || state == "active" {
|
|
return state
|
|
}
|
|
if state == "" {
|
|
return "active"
|
|
}
|
|
return state
|
|
}
|
|
|
|
func normalizeKratosState(status *string) string {
|
|
if status == nil {
|
|
return ""
|
|
}
|
|
value := strings.ToLower(strings.TrimSpace(*status))
|
|
if value == "blocked" {
|
|
return "inactive"
|
|
}
|
|
if value == "active" || value == "inactive" {
|
|
return value
|
|
}
|
|
return ""
|
|
}
|
|
|
|
func normalizePhoneNumber(phone string) string {
|
|
normalized := strings.ReplaceAll(phone, "-", "")
|
|
normalized = strings.ReplaceAll(normalized, " ", "")
|
|
if normalized == "" {
|
|
return ""
|
|
}
|
|
if strings.HasPrefix(normalized, "010") {
|
|
return "+82" + normalized[1:]
|
|
}
|
|
if strings.HasPrefix(normalized, "82") {
|
|
return "+" + normalized
|
|
}
|
|
return normalized
|
|
}
|
|
|
|
func (h *UserHandler) validateMetadata(metadata map[string]any, schema []interface{}, checkRequired bool) error {
|
|
return h.validateMetadataWithAuth(metadata, schema, true, checkRequired)
|
|
}
|
|
|
|
func (h *UserHandler) validateMetadataWithAuth(metadata map[string]any, schema []interface{}, isAdmin bool, checkRequired bool) error {
|
|
schemaMap := make(map[string]map[string]interface{})
|
|
for _, s := range schema {
|
|
if m, ok := s.(map[string]interface{}); ok {
|
|
if key, ok := m["key"].(string); ok {
|
|
schemaMap[key] = m
|
|
}
|
|
}
|
|
}
|
|
|
|
// 1. Check required fields
|
|
if checkRequired {
|
|
for key, config := range schemaMap {
|
|
required, _ := config["required"].(bool)
|
|
val, exists := metadata[key]
|
|
if required && (!exists || val == nil || val == "") {
|
|
return errors.New("field " + key + " is required")
|
|
}
|
|
}
|
|
}
|
|
|
|
// 2. Check each field in metadata
|
|
for key, val := range metadata {
|
|
config, exists := schemaMap[key]
|
|
if !exists {
|
|
continue // Ignore fields not in schema or allow? Let's allow for now
|
|
}
|
|
|
|
// Admin Only check
|
|
adminOnly, _ := config["adminOnly"].(bool)
|
|
if adminOnly && !isAdmin {
|
|
return errors.New("field " + key + " is admin only")
|
|
}
|
|
|
|
// Type validation
|
|
if expectedType, ok := config["type"].(string); ok && expectedType != "" && val != nil && val != "" {
|
|
switch expectedType {
|
|
case "number":
|
|
var numVal float64
|
|
switch v := val.(type) {
|
|
case float64:
|
|
numVal = v
|
|
case int:
|
|
numVal = float64(v)
|
|
case string:
|
|
parsed, err := strconv.ParseFloat(v, 64)
|
|
if err != nil {
|
|
return errors.New("field " + key + " must be a number")
|
|
}
|
|
numVal = parsed
|
|
default:
|
|
return errors.New("field " + key + " must be a number")
|
|
}
|
|
if float64(int(numVal)) != numVal {
|
|
return errors.New("field " + key + " must be an integer")
|
|
}
|
|
if unsigned, ok := config["unsigned"].(bool); ok && unsigned && numVal < 0 {
|
|
return errors.New("field " + key + " must be an unsigned integer")
|
|
}
|
|
case "float":
|
|
var numVal float64
|
|
switch v := val.(type) {
|
|
case float64:
|
|
numVal = v
|
|
case int:
|
|
numVal = float64(v)
|
|
case string:
|
|
parsed, err := strconv.ParseFloat(v, 64)
|
|
if err != nil {
|
|
return errors.New("field " + key + " must be a float")
|
|
}
|
|
numVal = parsed
|
|
default:
|
|
return errors.New("field " + key + " must be a float")
|
|
}
|
|
if unsigned, ok := config["unsigned"].(bool); ok && unsigned && numVal < 0 {
|
|
return errors.New("field " + key + " must be an unsigned float")
|
|
}
|
|
case "boolean":
|
|
switch v := val.(type) {
|
|
case bool:
|
|
// ok
|
|
case string:
|
|
if v != "true" && v != "false" {
|
|
return errors.New("field " + key + " must be a boolean")
|
|
}
|
|
default:
|
|
return errors.New("field " + key + " must be a boolean")
|
|
}
|
|
case "date":
|
|
if strVal, ok := val.(string); ok {
|
|
if _, err := time.Parse("2006-01-02", strVal); err != nil {
|
|
return errors.New("field " + key + " must be a valid date (YYYY-MM-DD)")
|
|
}
|
|
} else {
|
|
return errors.New("field " + key + " must be a date string")
|
|
}
|
|
case "datetime":
|
|
if strVal, ok := val.(string); ok {
|
|
_, err1 := time.Parse(time.RFC3339, strVal)
|
|
_, err2 := time.Parse("2006-01-02T15:04", strVal)
|
|
_, err3 := time.Parse("2006-01-02T15:04:05", strVal)
|
|
if err1 != nil && err2 != nil && err3 != nil {
|
|
return errors.New("field " + key + " must be a valid datetime")
|
|
}
|
|
} else {
|
|
return errors.New("field " + key + " must be a datetime string")
|
|
}
|
|
case "text":
|
|
if _, ok := val.(string); !ok {
|
|
return errors.New("field " + key + " must be a string")
|
|
}
|
|
}
|
|
}
|
|
|
|
// Regex validation
|
|
if regexStr, ok := config["validation"].(string); ok && regexStr != "" {
|
|
strVal := ""
|
|
switch v := val.(type) {
|
|
case string:
|
|
strVal = v
|
|
case float64:
|
|
strVal = fmt.Sprintf("%v", v)
|
|
case int:
|
|
strVal = fmt.Sprintf("%v", v)
|
|
}
|
|
|
|
if strVal != "" {
|
|
matched, err := regexp.MatchString(regexStr, strVal)
|
|
if err != nil {
|
|
return errors.New("invalid regex pattern for field " + key)
|
|
}
|
|
if !matched {
|
|
return errors.New("field " + key + " does not match validation pattern")
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|