WeKnora deployment source with the reviewed wiki identity, summary and recovery fixes

internal/application/repository/resource.go

@@ -0,0 +1,117 @@
+package repository
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/Tencent/WeKnora/internal/types"
+	"github.com/Tencent/WeKnora/internal/types/interfaces"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+)
+
+type resourceRepository struct{ db *gorm.DB }
+
+// NewResourceRepository creates the persistence adapter for resource metadata.
+func NewResourceRepository(db *gorm.DB) interfaces.ResourceRepository {
+	return &resourceRepository{db: db}
+}
+
+func (r *resourceRepository) Create(ctx context.Context, resource *types.StoredResource) error {
+	return r.db.WithContext(ctx).Create(resource).Error
+}
+
+func (r *resourceRepository) GetByID(ctx context.Context, id string) (*types.StoredResource, error) {
+	var resource types.StoredResource
+	err := r.db.WithContext(ctx).Where("id = ? AND state = ?", id, types.ResourceStateActive).First(&resource).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, nil
+	}
+	return &resource, err
+}
+
+func (r *resourceRepository) GetByHandle(ctx context.Context, handle string) (*types.StoredResource, error) {
+	var resource types.StoredResource
+	err := r.db.WithContext(ctx).
+		Where("handle = ? AND state = ?", handle, types.ResourceStateActive).
+		First(&resource).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, nil
+	}
+	return &resource, err
+}
+
+func (r *resourceRepository) GetByTenantLocation(
+	ctx context.Context,
+	tenantID uint64,
+	locationHash string,
+) (*types.StoredResource, error) {
+	var resource types.StoredResource
+	err := r.db.WithContext(ctx).
+		Where(
+			"tenant_id = ? AND location_hash = ? AND state = ?",
+			tenantID,
+			locationHash,
+			types.ResourceStateActive,
+		).
+		First(&resource).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, nil
+	}
+	return &resource, err
+}
+
+func (r *resourceRepository) MarkDeleted(ctx context.Context, id string) error {
+	return r.db.WithContext(ctx).Model(&types.StoredResource{}).Where("id = ?", id).
+		Updates(map[string]interface{}{"state": types.ResourceStateDeleted, "deleted_at": time.Now()}).Error
+}
+
+func (r *resourceRepository) CreateBinding(ctx context.Context, binding *types.ResourceBinding) error {
+	return r.db.WithContext(ctx).Clauses(clause.OnConflict{DoNothing: true}).Create(binding).Error
+}
+
+// DeleteBinding removes one owner's claim on a resource. Deleting a claim that
+// was never recorded is not an error: callers release optimistically, from a
+// content scan that cannot know which references were bound.
+func (r *resourceRepository) DeleteBinding(ctx context.Context, resourceID, ownerType, ownerID string) error {
+	return r.db.WithContext(ctx).
+		Where("resource_id = ? AND owner_type = ? AND owner_id = ?", resourceID, ownerType, ownerID).
+		Delete(&types.ResourceBinding{}).Error
+}
+
+func (r *resourceRepository) CountBindings(ctx context.Context, resourceID string) (int64, error) {
+	var count int64
+	err := r.db.WithContext(ctx).Model(&types.ResourceBinding{}).
+		Where("resource_id = ?", resourceID).
+		Count(&count).Error
+	return count, err
+}
+
+func (r *resourceRepository) CreateGrant(ctx context.Context, grant *types.ResourceAccessGrant) error {
+	return r.db.WithContext(ctx).Create(grant).Error
+}
+
+func (r *resourceRepository) GetValidGrant(
+	ctx context.Context,
+	tokenHash string,
+	now time.Time,
+) (*types.ResourceAccessGrant, error) {
+	var grant types.ResourceAccessGrant
+	err := r.db.WithContext(ctx).
+		Where("token_hash = ? AND revoked_at IS NULL AND expires_at > ?", tokenHash, now).
+		First(&grant).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, nil
+	}
+	return &grant, err
+}
+
+// DeleteExpiredGrants drops grants that are past their expiry. A revoked grant
+// is kept until then on purpose: it is the tombstone that stops a token derived
+// for the same resource and window from re-creating the row and reviving access.
+func (r *resourceRepository) DeleteExpiredGrants(ctx context.Context, before time.Time) error {
+	return r.db.WithContext(ctx).
+		Where("expires_at <= ?", before).
+		Delete(&types.ResourceAccessGrant{}).Error
+}