feat: Users API, ownership transfer and removal of the legacy role string

internal/infrastructure/useCases/AcceptInvite.go

@@ -4,6 +4,7 @@ import (
 	"RenewCMS/internal/domain/audit"
 	"RenewCMS/internal/domain/hash"
 	"RenewCMS/internal/domain/invite"
+	"RenewCMS/internal/domain/role"
 	"RenewCMS/internal/domain/user"
 	"context"
 	"errors"
@@ -14,6 +15,7 @@ import (
 type AcceptInviteUseCase struct {
 	userRepository   user.Repository
 	inviteRepository invite.Repository
+	roles            role.Repository
 	hasher           hash.Hasher
 	recorder         audit.Recorder
 }
@@ -24,8 +26,16 @@ type AcceptInviteCommand struct {
 	Password string
 }
 
-func NewAcceptInviteUseCase(userRepository user.Repository, inviteRepository invite.Repository, hasher hash.Hasher, recorder audit.Recorder) *AcceptInviteUseCase {
-	return &AcceptInviteUseCase{userRepository, inviteRepository, hasher, recorder}
+func NewAcceptInviteUseCase(userRepository user.Repository, inviteRepository invite.Repository, roles role.Repository, hasher hash.Hasher, recorder audit.Recorder) *AcceptInviteUseCase {
+	return &AcceptInviteUseCase{userRepository, inviteRepository, roles, hasher, recorder}
+}
+
+func (a *AcceptInviteUseCase) invitedRole(pending invite.Invite) (role.Role, error) {
+	assigned, err := assignableRole(a.roles, pending.RoleID)
+	if errors.Is(err, role.ErrUnknownRole) || errors.Is(err, role.ErrRoleLocked) {
+		return role.Role{}, invite.ErrInviteInvalid
+	}
+	return assigned, err
 }
 
 func (a *AcceptInviteUseCase) AcceptInvite(ctx context.Context, command AcceptInviteCommand) (user.User, error) {
@@ -39,11 +49,18 @@ func (a *AcceptInviteUseCase) AcceptInvite(ctx context.Context, command AcceptIn
 	}
 	event.Target = inviteTarget(pending)
 
-	created, err := a.accept(command, pending, now)
+	assigned, err := a.invitedRole(pending)
 	if err != nil {
 		a.recordRefusal(ctx, event, command, err)
 		return user.User{}, err
 	}
+
+	created, err := a.accept(command, pending, assigned, now)
+	if err != nil {
+		a.recordRefusal(ctx, event, command, err)
+		return user.User{}, err
+	}
+	event = inviteRoleParams(event, assigned)
 	event.Actor = audit.UserActor(created)
 	a.recorder.Record(ctx, event)
 	return created, nil
@@ -54,7 +71,7 @@ func (a *AcceptInviteUseCase) recordRefusal(ctx context.Context, event audit.Eve
 	recordFailure(ctx, a.recorder, event, cause)
 }
 
-func (a *AcceptInviteUseCase) accept(command AcceptInviteCommand, pending invite.Invite, now time.Time) (user.User, error) {
+func (a *AcceptInviteUseCase) accept(command AcceptInviteCommand, pending invite.Invite, assigned role.Role, now time.Time) (user.User, error) {
 	if a.emailHasAccount(pending.Email) {
 		if _, err := findUsableInvite(a.inviteRepository, a.hasher, command.Code, now); err != nil {
 			return user.User{}, err
@@ -80,7 +97,7 @@ func (a *AcceptInviteUseCase) accept(command AcceptInviteCommand, pending invite
 		Password:   hashedPassword,
 		Email:      pending.Email,
 		IsVerified: true,
-		Role:       user.RoleAdmin,
+		RoleID:     assigned.ID,
 	})
 	if errors.Is(err, invite.ErrInviteNotFound) {
 		return user.User{}, invite.ErrInviteInvalid