mygo/internal/repository/session.go

package repository

import (
	"context"
	"errors"
	"time"

	"gorm.io/gorm"
	"gorm.io/gorm/clause"

	"github.com/dhao2001/mygo/internal/model"
)

// RefreshSessionParams contains the fields persisted for a refresh session.
type RefreshSessionParams struct {
	ID        string
	UserID    string
	TokenHash string
	ExpiresAt time.Time
}

// AuthSessionRepository exposes only session operations required by AuthService.
type AuthSessionRepository interface {
	CreateRefreshSession(ctx context.Context, params RefreshSessionParams) error
	ConsumeRefreshSession(ctx context.Context, tokenHash string) (*model.Session, error)
	RevokeRefreshSession(ctx context.Context, tokenHash string) error
}

// SessionRepository is the composition-time union of session capabilities.
type SessionRepository interface {
	AuthSessionRepository
	FindByID(ctx context.Context, id string) (*model.Session, error)
	FindByTokenHash(ctx context.Context, tokenHash string) (*model.Session, error)
	DeleteSessionsByUserID(ctx context.Context, userID string) error
	DeleteExpiredSessions(ctx context.Context) (int64, error)
}

type sessionRepository struct {
	db *gorm.DB
}

// NewSessionRepository creates a SessionRepository backed by GORM.
func NewSessionRepository(db *gorm.DB) SessionRepository {
	return &sessionRepository{db: db}
}

func (r *sessionRepository) CreateRefreshSession(ctx context.Context, params RefreshSessionParams) error {
	session := &model.Session{
		ID:        params.ID,
		UserID:    params.UserID,
		TokenHash: params.TokenHash,
		ExpiresAt: params.ExpiresAt,
	}
	result := r.db.WithContext(ctx).Create(session)
	if result.Error != nil {
		if isDuplicateKeyError(result.Error) {
			return model.ErrDuplicate
		}
		return result.Error
	}
	return nil
}

func (r *sessionRepository) FindByID(ctx context.Context, id string) (*model.Session, error) {
	var session model.Session
	result := r.db.WithContext(ctx).First(&session, "id = ?", id)
	if errors.Is(result.Error, gorm.ErrRecordNotFound) {
		return nil, model.ErrNotFound
	}
	if result.Error != nil {
		return nil, result.Error
	}
	return &session, nil
}

func (r *sessionRepository) FindByTokenHash(ctx context.Context, tokenHash string) (*model.Session, error) {
	var session model.Session
	result := r.db.WithContext(ctx).First(&session, "token_hash = ?", tokenHash)
	if errors.Is(result.Error, gorm.ErrRecordNotFound) {
		return nil, model.ErrNotFound
	}
	if result.Error != nil {
		return nil, result.Error
	}
	return &session, nil
}

func (r *sessionRepository) ConsumeRefreshSession(ctx context.Context, tokenHash string) (*model.Session, error) {
	var consumed model.Session
	err := r.db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
		result := tx.Clauses(clause.Locking{Strength: clause.LockingStrengthUpdate}).
			First(&consumed, "token_hash = ?", tokenHash)
		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
			return model.ErrNotFound
		}
		if result.Error != nil {
			return result.Error
		}

		result = tx.Delete(&model.Session{}, "id = ?", consumed.ID)
		if result.Error != nil {
			return result.Error
		}
		if result.RowsAffected == 0 {
			return model.ErrNotFound
		}
		return nil
	})
	if err != nil {
		return nil, err
	}
	return &consumed, nil
}

func (r *sessionRepository) RevokeRefreshSession(ctx context.Context, tokenHash string) error {
	result := r.db.WithContext(ctx).Delete(&model.Session{}, "token_hash = ?", tokenHash)
	return result.Error
}

func (r *sessionRepository) DeleteSessionsByUserID(ctx context.Context, userID string) error {
	result := r.db.WithContext(ctx).Delete(&model.Session{}, "user_id = ?", userID)
	if result.Error != nil {
		return result.Error
	}
	return nil
}

func (r *sessionRepository) DeleteExpiredSessions(ctx context.Context) (int64, error) {
	result := r.db.WithContext(ctx).Delete(&model.Session{}, "expires_at < ?", time.Now())
	if result.Error != nil {
		return 0, result.Error
	}
	return result.RowsAffected, nil
}