fix: squadless-provision warning + real AssignToSquad (T1-3)

Author: Fr1ngg

internal/adapter/remnawave/circuit_breaker.go

@@ -26,6 +26,7 @@ const (
 	TimeoutGetUser     = 5 * time.Second
 	TimeoutUpdateUser  = 5 * time.Second
 	TimeoutGetNodes    = 10 * time.Second
+	TimeoutAssignSquad = 5 * time.Second
 )
 
 // Prometheus metric constants for the circuit breaker.
@@ -191,3 +192,13 @@ func (rc *ResilientClient) DisableUser(ctx context.Context, uuid string) error {
 		return rc.client.DisableUser(ctx, uuid)
 	})
 }
+
+// AddUsersToInternalSquad assigns users to an internal squad through the
+// circuit breaker.
+func (rc *ResilientClient) AddUsersToInternalSquad(ctx context.Context, squadUUID string, userUUIDs []string) error {
+	ctx, cancel := withTimeout(ctx, TimeoutAssignSquad)
+	defer cancel()
+	return cbExecNoResult(rc.cb, func() error {
+		return rc.client.AddUsersToInternalSquad(ctx, squadUUID, userUUIDs)
+	})
+}

internal/adapter/remnawave/gateway_adapter.go

@@ -3,6 +3,7 @@ package remnawave
 import (
 	"context"
 	"fmt"
+	"log/slog"
 
 	"github.com/BEDOLAGA-DEV/RemnaCore/internal/domain/multisub"
 	"github.com/BEDOLAGA-DEV/RemnaCore/pkg/clock"
@@ -19,13 +20,17 @@ type GatewayAdapter struct {
 	client                *ResilientClient
 	clock                 clock.Clock
 	defaultInternalSquads []string
+	logger                *slog.Logger
 }
 
 // NewGatewayAdapter creates a GatewayAdapter backed by the given resilient
 // client. defaultInternalSquads is applied to every CreateUser call that does
 // not supply its own ActiveInternalSquads override.
-func NewGatewayAdapter(client *ResilientClient, clk clock.Clock, defaultInternalSquads []string) *GatewayAdapter {
-	return &GatewayAdapter{client: client, clock: clk, defaultInternalSquads: defaultInternalSquads}
+func NewGatewayAdapter(client *ResilientClient, clk clock.Clock, defaultInternalSquads []string, logger *slog.Logger) *GatewayAdapter {
+	if logger == nil {
+		logger = slog.Default()
+	}
+	return &GatewayAdapter{client: client, clock: clk, defaultInternalSquads: defaultInternalSquads, logger: logger}
 }
 
 // CreateUser provisions a VPN user in Remnawave, translating the domain
@@ -39,6 +44,13 @@ func (a *GatewayAdapter) CreateUser(ctx context.Context, req multisub.CreateRemn
 	if len(rwReq.ActiveInternalSquads) == 0 {
 		rwReq.ActiveInternalSquads = a.defaultInternalSquads
 	}
+	if len(rwReq.ActiveInternalSquads) == 0 {
+		// A user with no internal squads gets an EMPTY, non-working subscription
+		// (no inbounds). This is almost always a misconfiguration — warn loudly
+		// per provision, not just once at boot, so it surfaces in operations.
+		a.logger.WarnContext(ctx, "remnawave: provisioning VPN user with NO internal squads — subscription will not work; set REMNAWAVE_DEFAULT_INTERNAL_SQUADS or supply squads per request",
+			slog.String("username", req.Username))
+	}
 	if req.ExpireAt != nil {
 		rwReq.ExpireAt = *req.ExpireAt
 	} else {
@@ -96,11 +108,12 @@ func (a *GatewayAdapter) DisableUser(ctx context.Context, remnawaveUUID string)
 	return nil
 }
 
-// AssignToSquad assigns a Remnawave user to a squad (server group). This maps
-// to a future Remnawave API endpoint; currently a no-op placeholder that
-// returns nil to indicate success.
-func (a *GatewayAdapter) AssignToSquad(_ context.Context, _, _ string) error {
-	// TODO: implement when Remnawave adds squad assignment API endpoint.
+// AssignToSquad assigns a Remnawave user to an internal squad (server group)
+// via the bulk-add-users endpoint.
+func (a *GatewayAdapter) AssignToSquad(ctx context.Context, remnawaveUUID, squadUUID string) error {
+	if err := a.client.AddUsersToInternalSquad(ctx, squadUUID, []string{remnawaveUUID}); err != nil {
+		return fmt.Errorf("remnawave assign user %s to squad %s: %w", remnawaveUUID, squadUUID, err)
+	}
 	return nil
 }
 

internal/adapter/remnawave/gateway_adapter_test.go

@@ -24,7 +24,7 @@ func TestGatewayAdapter_CreateUser_AppliesSquads(t *testing.T) {
 	}))
 	defer srv.Close()
 	mk := func(def []string) *GatewayAdapter {
-		return NewGatewayAdapter(NewResilientClient(NewClient(srv.URL, "t"), circuitbreaker.DefaultConfig(), slog.Default()), clock.NewReal(), def)
+		return NewGatewayAdapter(NewResilientClient(NewClient(srv.URL, "t"), circuitbreaker.DefaultConfig(), slog.Default()), clock.NewReal(), def, slog.Default())
 	}
 	_, err := mk([]string{"default-sq"}).CreateUser(context.Background(), multisub.CreateRemnawaveUserRequest{Username: "u"})
 	require.NoError(t, err)
@@ -51,7 +51,7 @@ func TestGatewayAdapter_GetUser_StatusMapping(t *testing.T) {
 		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			fmt.Fprintf(w, `{"response":{"uuid":"u1","status":%q,"userTraffic":{"usedTrafficBytes":1024}}}`, tc.status)
 		}))
-		a := NewGatewayAdapter(NewResilientClient(NewClient(srv.URL, "t"), circuitbreaker.DefaultConfig(), slog.Default()), clock.NewReal(), nil)
+		a := NewGatewayAdapter(NewResilientClient(NewClient(srv.URL, "t"), circuitbreaker.DefaultConfig(), slog.Default()), clock.NewReal(), nil, slog.Default())
 		got, err := a.GetUser(context.Background(), "u1")
 		require.NoError(t, err)
 		require.Equal(t, tc.wantEnabled, got.Enabled, "status %s enabled", tc.status)
@@ -60,3 +60,20 @@ func TestGatewayAdapter_GetUser_StatusMapping(t *testing.T) {
 		srv.Close()
 	}
 }
+
+func TestGatewayAdapter_AssignToSquad_HitsBulkAddEndpoint(t *testing.T) {
+	var gotPath string
+	var gotBody []byte
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotPath = r.URL.Path
+		gotBody, _ = io.ReadAll(r.Body)
+		_, _ = w.Write([]byte(`{"response":{}}`))
+	}))
+	defer srv.Close()
+
+	a := NewGatewayAdapter(NewResilientClient(NewClient(srv.URL, "t"), circuitbreaker.DefaultConfig(), slog.Default()), clock.NewReal(), nil, slog.Default())
+	err := a.AssignToSquad(context.Background(), "user-uuid-1", "squad-uuid-9")
+	require.NoError(t, err)
+	require.Equal(t, "/api/internal-squads/squad-uuid-9/bulk-actions/add-users", gotPath)
+	require.Contains(t, string(gotBody), "user-uuid-1")
+}

internal/app/wiring_multisub.go

@@ -56,7 +56,7 @@ var multisubWiring = fx.Options(
 			logger.Warn("remnawave: no default internal squads configured; new VPN users will be provisioned without squads (empty/non-working subscriptions) unless a per-request override is supplied",
 				slog.String("config_key", "remnawave.default_internal_squads"))
 		}
-		return remnawave.NewGatewayAdapter(client, clk, cfg.Remnawave.DefaultInternalSquads)
+		return remnawave.NewGatewayAdapter(client, clk, cfg.Remnawave.DefaultInternalSquads, logger)
 	}),
 	fx.Provide(func(adapter *remnawave.GatewayAdapter) multisub.RemnawaveGateway { return adapter }),