feat(roles): db is now role source of truth

Author: shamikkarkhanis

README.md

@@ -124,16 +124,34 @@ make test-all
 ## Development Scripts
 Helper scripts are located in the `scripts/` directory.
 
-### Create Development User
-Seeds a user into the DB and generates a valid JWT for testing.
+### Create User
+Seeds or updates a user in the database and prints a JWT for that user. `--email` is required; the other fields have defaults.
 ```bash
-go run scripts/create_dev_user/main.go
+go run scripts/create_user/main.go --email dev@example.com --role dev
 ```
 
-### Generate Token
-Manually generates a JWT for an existing user (by email).
+### Run DB-Connected Scripts Without Go in the API Image
+If you are running the API and Postgres with Docker Compose, the API container does not include the Go toolchain. To run local Go scripts that need database access, start a one-off Go container on the same Compose network and mount the repository into it.
+
+Current local network:
+```bash
+api_default
+```
+
+Example:
+```bash
+docker run --rm \
+  --network api_default \
+  -v "$PWD":/app \
+  -w /app \
+  --env-file .env \
+  golang:1.25 \
+  go run scripts/create_user/main.go --email dev@example.com --role dev
+```
+
+If your Compose project name is different, the network name will usually be `<project>_default`. You can check it with:
 ```bash
-go run scripts/generate_token/main.go
+docker network ls
 ```
 
 ## Project Structure

docker-compose.yml

@@ -25,14 +25,14 @@ services:
       db:
         condition: service_healthy
 
-  # tunnel:
-  #   image: cloudflare/cloudflared:latest
-  #   restart: unless-stopped
-  #   command: tunnel run
-  #   env_file:
-  #     - .env
-  #   depends_on:
-  #     - api
+  tunnel:
+    image: cloudflare/cloudflared:latest
+    restart: unless-stopped
+    command: tunnel run
+    env_file:
+      - .env
+    depends_on:
+      - api
 
 volumes:
   pgdata:

internal/database/models.go

@@ -123,7 +123,21 @@ ON CONFLICT (uid, eid) DO UPDATE SET is_attending = $3;
 DELETE FROM event_registrations WHERE uid = $1 AND eid = $2;
 
 -- name: IsEventAdmin :one
-SELECT is_admin FROM event_registrations WHERE uid = $1 AND eid = $2;
+SELECT EXISTS (
+    SELECT 1
+    FROM event_registrations er
+    WHERE er.uid = $1
+      AND er.eid = $2
+      AND er.is_admin = TRUE
+)
+OR EXISTS (
+    SELECT 1
+    FROM event_hosting eh
+    JOIN org_members om ON om.oid = eh.oid
+    WHERE eh.eid = $2
+      AND om.uid = $1
+      AND om.is_admin = TRUE
+);
 
 -- name: GetUserEvents :many
 SELECT e.*, er.is_attending, er.is_admin, er.date_registered

internal/database/queries.sql

@@ -17,7 +17,7 @@ type CreateUserRequest struct {
 	SchoolEmail   string `json:"school_email,omitempty" validate:"omitempty,email"`
 	Phone         string `json:"phone,omitempty"`
 	GradYear      int    `json:"grad_year,omitempty" validate:"omitempty,gte=2000,lte=2100"`
-	Role          string `json:"role,omitempty" validate:"omitempty,oneof=student alumni faculty external"`
+	Role          string `json:"role,omitempty" validate:"omitempty,oneof=student alumni faculty external dev"`
 }
 
 type UpdateUserRequest struct {
@@ -27,7 +27,7 @@ type UpdateUserRequest struct {
 	SchoolEmail   *string `json:"school_email,omitempty" validate:"omitempty,email"`
 	Phone         *string `json:"phone,omitempty"`
 	GradYear      *int    `json:"grad_year,omitempty" validate:"omitempty,gte=2000,lte=2100"`
-	Role          *string `json:"role,omitempty" validate:"omitempty,oneof=student alumni faculty external"`
+	Role          *string `json:"role,omitempty" validate:"omitempty,oneof=student alumni faculty external dev"`
 }
 
 type UserResponse struct {

internal/database/queries.sql.go

@@ -311,7 +311,7 @@ func (h *Handler) RefreshToken(w http.ResponseWriter, r *http.Request) {
 
 // ListBotTokens lists all bot tokens
 // @Summary      List bot tokens
-// @Description  Returns all bot tokens (requires faculty role)
+// @Description  Returns all bot tokens (requires dev role)
 // @Tags         bot
 // @Accept       json
 // @Produce      json
@@ -320,7 +320,7 @@ func (h *Handler) RefreshToken(w http.ResponseWriter, r *http.Request) {
 // @Security     CookieAuth
 // @Router       /bot/tokens [get]
 func (h *Handler) ListBotTokens(w http.ResponseWriter, r *http.Request) {
-	if !h.requireFaculty(w, r) {
+	if !h.requireDev(w, r) {
 		return
 	}
 
@@ -346,7 +346,7 @@ func (h *Handler) ListBotTokens(w http.ResponseWriter, r *http.Request) {
 
 // CreateBotToken creates a new bot token
 // @Summary      Create bot token
-// @Description  Creates a new bot token (requires faculty role). The raw token is returned only once and must be stored by the caller.
+// @Description  Creates a new bot token (requires dev role). The raw token is returned only once and must be stored by the caller.
 // @Tags         bot
 // @Accept       json
 // @Produce      json
@@ -357,7 +357,7 @@ func (h *Handler) ListBotTokens(w http.ResponseWriter, r *http.Request) {
 // @Security     CookieAuth
 // @Router       /bot/tokens [post]
 func (h *Handler) CreateBotToken(w http.ResponseWriter, r *http.Request) {
-	claims, ok := h.requireFacultyClaims(w, r)
+	claims, ok := h.requireDevClaims(w, r)
 	if !ok {
 		return
 	}
@@ -412,7 +412,7 @@ func (h *Handler) CreateBotToken(w http.ResponseWriter, r *http.Request) {
 
 // RevokeBotToken revokes a bot token
 // @Summary      Revoke bot token
-// @Description  Revokes a bot token (requires faculty role)
+// @Description  Revokes a bot token (requires dev role)
 // @Tags         bot
 // @Accept       json
 // @Produce      json
@@ -423,7 +423,7 @@ func (h *Handler) CreateBotToken(w http.ResponseWriter, r *http.Request) {
 // @Security     CookieAuth
 // @Router       /bot/tokens/{token_id} [delete]
 func (h *Handler) RevokeBotToken(w http.ResponseWriter, r *http.Request) {
-	if !h.requireFaculty(w, r) {
+	if !h.requireDev(w, r) {
 		return
 	}
 
@@ -475,7 +475,6 @@ func (h *Handler) generateJWT(user database.User) (string, error) {
 	claims := &middleware.UserClaims{
 		UserID: user.Uid.String(),
 		Email:  getEmail(user),
-		Role:   string(user.Role.UserRole),
 		RegisteredClaims: jwt.RegisteredClaims{
 			ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Duration(h.Config.JWT.ExpiryHours) * time.Hour)),
 			IssuedAt:  jwt.NewNumericDate(time.Now()),
@@ -585,7 +584,8 @@ func (h *Handler) verifyStateCookie(w http.ResponseWriter, r *http.Request, stat
 }
 
 func (h *Handler) upsertUser(ctx context.Context, email, firstName, lastName string) (database.User, error) {
-	pgEmail := toPgTextFromString(email)
+	normalizedEmail := normalizeEmail(email)
+	pgEmail := toPgTextFromString(normalizedEmail)
 
 	// Check if user exists
 	user, err := h.queries.GetUserByEmail(ctx, pgEmail)
@@ -603,7 +603,7 @@ func (h *Handler) upsertUser(ctx context.Context, email, firstName, lastName str
 		LastName:      lastName,
 		PersonalEmail: pgEmail, // Default to personal email for oauth
 		SchoolEmail:   pgtype.Text{Valid: false},
-		Role:          database.NullUserRole{UserRole: database.UserRoleStudent, Valid: true}, // Default role
+		Role:          database.NullUserRole{UserRole: database.UserRoleStudent, Valid: true},
 	})
 }
 
@@ -628,35 +628,3 @@ func generateSecureToken(length int) (string, error) {
 func formatBotToken(tokenID uuid.UUID, secret string) string {
 	return tokenID.String() + "." + secret
 }
-
-func (h *Handler) requireFaculty(w http.ResponseWriter, r *http.Request) bool {
-	_, ok := h.requireFacultyClaims(w, r)
-	return ok
-}
-
-func (h *Handler) requireFacultyClaims(w http.ResponseWriter, r *http.Request) (*middleware.UserClaims, bool) {
-	claims, ok := middleware.GetUserClaims(r.Context())
-	if !ok {
-		h.respondError(w, http.StatusUnauthorized, "Not authenticated")
-		return nil, false
-	}
-
-	uid, err := uuid.Parse(claims.UserID)
-	if err != nil {
-		h.respondError(w, http.StatusUnauthorized, "Invalid user ID in token")
-		return nil, false
-	}
-
-	user, err := h.queries.GetUserByID(r.Context(), uid)
-	if err != nil {
-		h.handleDBError(w, err)
-		return nil, false
-	}
-
-	if !user.Role.Valid || user.Role.UserRole != database.UserRoleFaculty {
-		h.respondError(w, http.StatusForbidden, "Faculty role required")
-		return nil, false
-	}
-
-	return claims, true
-}

internal/dto/dto.go

@@ -0,0 +1,63 @@
+package handler
+
+import (
+	"context"
+	"testing"
+
+	"github.com/capyrpi/api/internal/config"
+	"github.com/capyrpi/api/internal/database"
+	"github.com/capyrpi/api/internal/database/mocks"
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgtype"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+)
+
+func TestUpsertUserCreatesStudentByDefault(t *testing.T) {
+	mockQueries := mocks.NewQuerier(t)
+	h := New(mockQueries, &config.Config{Env: "development"})
+
+	mockQueries.On("GetUserByEmail", mock.Anything, pgtype.Text{
+		String: "student@example.com",
+		Valid:  true,
+	}).Return(database.User{}, pgx.ErrNoRows).Once()
+	mockQueries.On("CreateUser", mock.Anything, mock.MatchedBy(func(arg database.CreateUserParams) bool {
+		return arg.FirstName == "Grace" &&
+			arg.LastName == "Hopper" &&
+			arg.PersonalEmail.Valid &&
+			arg.PersonalEmail.String == "student@example.com" &&
+			arg.Role.Valid &&
+			arg.Role.UserRole == database.UserRoleStudent
+	})).Return(database.User{
+		Uid:           uuid.New(),
+		PersonalEmail: pgtype.Text{String: "student@example.com", Valid: true},
+		Role:          database.NullUserRole{UserRole: database.UserRoleStudent, Valid: true},
+	}, nil).Once()
+
+	user, err := h.upsertUser(context.Background(), " Student@Example.com ", "Grace", "Hopper")
+
+	assert.NoError(t, err)
+	assert.Equal(t, database.UserRoleStudent, user.Role.UserRole)
+}
+
+func TestUpsertUserReturnsExistingUserWithoutRolePromotion(t *testing.T) {
+	mockQueries := mocks.NewQuerier(t)
+	h := New(mockQueries, &config.Config{Env: "development"})
+	userID := uuid.New()
+
+	mockQueries.On("GetUserByEmail", mock.Anything, pgtype.Text{
+		String: "dev@example.com",
+		Valid:  true,
+	}).Return(database.User{
+		Uid:           userID,
+		PersonalEmail: pgtype.Text{String: "dev@example.com", Valid: true},
+		Role:          database.NullUserRole{UserRole: database.UserRoleStudent, Valid: true},
+	}, nil).Once()
+
+	user, err := h.upsertUser(context.Background(), " dev@example.com ", "Katherine", "Johnson")
+
+	assert.NoError(t, err)
+	assert.Equal(t, userID, user.Uid)
+	assert.Equal(t, database.UserRoleStudent, user.Role.UserRole)
+}