Pulse/internal/api/access_tenant_provider.go

package api

import (
	"errors"
	"fmt"
	"os"
	"path/filepath"
	"regexp"
	"sync"

	"github.com/rcourtman/pulse-go-rewrite/internal/securityutil"
	"github.com/rcourtman/pulse-go-rewrite/pkg/auth"
)

var tenantRBACOrgIDPattern = regexp.MustCompile(`^[A-Za-z0-9._-]{1,64}$`)

// TenantRBACProvider manages per-tenant RBAC Manager instances.
// Follows the same file-based isolation pattern as MultiTenantPersistence.
type TenantRBACProvider struct {
	baseDataDir string
	mu          sync.RWMutex
	managers    map[string]*auth.SQLiteManager
}

// NewTenantRBACProvider creates a new provider.
func NewTenantRBACProvider(baseDataDir string) *TenantRBACProvider {
	return &TenantRBACProvider{
		baseDataDir: baseDataDir,
		managers:    make(map[string]*auth.SQLiteManager),
	}
}

// PeekManager returns an already-initialized RBAC Manager for the given org
// without creating one. Read-only callers that must not have side effects —
// notably the usage telemetry snapshot — use this so a background read never
// provisions an RBAC store for an org that has never used RBAC.
func (p *TenantRBACProvider) PeekManager(orgID string) (auth.ExtendedManager, bool) {
	if p == nil {
		return nil, false
	}
	orgID = normalizeOrgID(orgID)

	p.mu.RLock()
	defer p.mu.RUnlock()
	manager, exists := p.managers[orgID]
	if !exists || manager == nil {
		return nil, false
	}
	return manager, true
}

// GetManager returns the RBAC Manager for the given org, creating it lazily if needed.
// For "default" org: DataDir = baseDataDir (db at {baseDataDir}/rbac/rbac.db — existing location).
// For other orgs: DataDir = {baseDataDir}/orgs/{orgID} (db at {baseDataDir}/orgs/{orgID}/rbac/rbac.db).
func (p *TenantRBACProvider) GetManager(orgID string) (auth.ExtendedManager, error) {
	orgID = normalizeOrgID(orgID)

	p.mu.RLock()
	manager, exists := p.managers[orgID]
	p.mu.RUnlock()
	if exists {
		return manager, nil
	}

	p.mu.Lock()
	defer p.mu.Unlock()

	// Double-check locking pattern.
	if manager, exists = p.managers[orgID]; exists {
		return manager, nil
	}

	dataDir, err := p.resolveDataDir(orgID)
	if err != nil {
		return nil, err
	}

	manager, err = auth.NewSQLiteManager(auth.SQLiteManagerConfig{
		DataDir:          dataDir,
		MigrateFromFiles: orgID == "default",
	})
	if err != nil {
		return nil, fmt.Errorf("failed to initialize RBAC manager for org %s: %w", orgID, err)
	}

	p.managers[orgID] = manager
	RecordRBACManagerCreated()
	return manager, nil
}

// RemoveTenant closes and removes the cached manager for the given org.
// Called when an org is deleted.
func (p *TenantRBACProvider) RemoveTenant(orgID string) error {
	orgID = normalizeOrgID(orgID)

	p.mu.Lock()
	manager, exists := p.managers[orgID]
	if exists {
		delete(p.managers, orgID)
		RecordRBACManagerRemoved()
	}
	p.mu.Unlock()

	if !exists {
		return nil
	}

	if err := manager.Close(); err != nil {
		return fmt.Errorf("failed to close RBAC manager for org %s: %w", orgID, err)
	}

	return nil
}

// Close closes all cached managers.
func (p *TenantRBACProvider) Close() error {
	p.mu.Lock()
	managers := p.managers
	p.managers = make(map[string]*auth.SQLiteManager)
	p.mu.Unlock()

	var closeErr error
	for orgID, manager := range managers {
		if err := manager.Close(); err != nil {
			closeErr = errors.Join(closeErr, fmt.Errorf("failed to close RBAC manager for org %s: %w", orgID, err))
		}
	}

	ensureRBACMetrics()
	rbacManagersActive.Set(0)

	return closeErr
}

// ManagerCount returns the number of cached managers. Used for testing.
func (p *TenantRBACProvider) ManagerCount() int {
	p.mu.RLock()
	defer p.mu.RUnlock()
	return len(p.managers)
}

func (p *TenantRBACProvider) ownsManager(manager auth.Manager) bool {
	if manager == nil {
		return false
	}
	p.mu.RLock()
	defer p.mu.RUnlock()
	for _, candidate := range p.managers {
		if manager == candidate {
			return true
		}
	}
	return false
}

func (p *TenantRBACProvider) resolveDataDir(orgID string) (string, error) {
	baseDataDir, err := securityutil.NormalizeStorageDir(p.baseDataDir)
	if err != nil {
		return "", fmt.Errorf("invalid RBAC data directory: %w", err)
	}
	if orgID == "default" {
		return baseDataDir, nil
	}

	if !isValidTenantOrgID(orgID) {
		return "", fmt.Errorf("invalid organization ID: %s", orgID)
	}

	orgsDir, err := securityutil.JoinStorageLeaf(baseDataDir, "orgs")
	if err != nil {
		return "", fmt.Errorf("resolve organization storage root: %w", err)
	}
	orgDir, err := securityutil.JoinStorageLeaf(orgsDir, orgID)
	if err != nil {
		return "", fmt.Errorf("resolve organization directory: %w", err)
	}
	stat, err := os.Lstat(orgDir)
	if err != nil {
		if os.IsNotExist(err) {
			return "", fmt.Errorf("organization directory does not exist: %s", orgID)
		}
		return "", fmt.Errorf("failed to read organization directory for %s: %w", orgID, err)
	}
	if stat.Mode()&os.ModeSymlink != 0 {
		return "", fmt.Errorf("organization path must not be a symlink: %s", orgID)
	}
	if !stat.IsDir() {
		return "", fmt.Errorf("organization path is not a directory: %s", orgID)
	}

	return orgDir, nil
}

func normalizeOrgID(orgID string) string {
	if orgID == "" {
		return "default"
	}
	return orgID
}

func isValidTenantOrgID(orgID string) bool {
	if orgID == "" || orgID == "." || orgID == ".." {
		return false
	}
	if filepath.Base(orgID) != orgID {
		return false
	}
	return tenantRBACOrgIDPattern.MatchString(orgID)
}