fix: platform-scope pre-auth identity paths (RLS regression under app role)

Fr1ngg · Fr1ngg · commit c7dfa2dd69b6 · 2026-07-03T07:29:58.000+03:00
diff --git a/internal/domain/identity/service/identity_profile.go b/internal/domain/identity/service/identity_profile.go
@@ -9,6 +9,7 @@ import (
 	"github.com/BEDOLAGA-DEV/RemnaCore/internal/domain/identity/aggregate"
 	"github.com/BEDOLAGA-DEV/RemnaCore/pkg/authutil"
 	"github.com/BEDOLAGA-DEV/RemnaCore/pkg/domainevent"
+	"github.com/BEDOLAGA-DEV/RemnaCore/pkg/tenantctx"
 )
 
 // VerifyEmail validates the token, marks the user's email as verified, removes
@@ -26,7 +27,10 @@ func (s *Service) VerifyEmail(ctx context.Context, token string) error {
 		return ErrTokenExpired
 	}
 
-	return s.txRunner.RunInTx(ctx, func(txCtx context.Context) error {
+	// Pre-auth (public /auth/verify-email): no tenant context, and
+	// identity.platform_users is FORCE RLS, so run under the platform sentinel or
+	// the user row is invisible and verification always fails.
+	return s.txRunner.RunInTx(tenantctx.WithPlatformScope(ctx), func(txCtx context.Context) error {
 		user, err := s.repo.GetUserByIDForUpdate(txCtx, verification.UserID)
 		if err != nil {
 			return fmt.Errorf("finding user: %w", err)
@@ -45,19 +49,38 @@ func (s *Service) VerifyEmail(ctx context.Context, token string) error {
 	})
 }
 
-// GetMe retrieves the authenticated user's profile by ID.
+// GetMe retrieves the authenticated user's profile by ID. Wrapped in RunInTx so
+// the caller's scope (WithPlatformScope for admins / WithTenantID for tenant
+// users, both set by ShopResolver) reaches the DB as the app.tenant_id GUC —
+// without it, identity.platform_users FORCE RLS hides even the caller's own row.
 func (s *Service) GetMe(ctx context.Context, userID string) (*aggregate.PlatformUser, error) {
-	user, err := s.repo.GetUserByID(ctx, userID)
-	if err != nil {
+	var user *aggregate.PlatformUser
+	if err := s.txRunner.RunInTx(ctx, func(txCtx context.Context) error {
+		u, err := s.repo.GetUserByID(txCtx, userID)
+		if err != nil {
+			return err
+		}
+		user = u
+		return nil
+	}); err != nil {
 		return nil, fmt.Errorf("finding user: %w", err)
 	}
 	return user, nil
 }
 
-// GetByTelegramID retrieves a user by their linked Telegram ID.
+// GetByTelegramID retrieves a user by their linked Telegram ID. Runs under the
+// platform sentinel: it is used by pre-auth Telegram flows with no tenant
+// context, and platform_users FORCE RLS would otherwise hide the row.
 func (s *Service) GetByTelegramID(ctx context.Context, telegramID int64) (*aggregate.PlatformUser, error) {
-	user, err := s.repo.GetUserByTelegramID(ctx, telegramID)
-	if err != nil {
+	var user *aggregate.PlatformUser
+	if err := s.txRunner.RunInTx(tenantctx.WithPlatformScope(ctx), func(txCtx context.Context) error {
+		u, err := s.repo.GetUserByTelegramID(txCtx, telegramID)
+		if err != nil {
+			return err
+		}
+		user = u
+		return nil
+	}); err != nil {
 		return nil, fmt.Errorf("finding user by telegram id: %w", err)
 	}
 	return user, nil
@@ -140,8 +163,18 @@ func (s *Service) ListUsers(ctx context.Context, limit, offset int) ([]*aggregat
 // publishes a PasswordResetRequested event. If the email is not found, no error
 // is returned to prevent user enumeration.
 func (s *Service) RequestPasswordReset(ctx context.Context, email string) error {
-	user, err := s.repo.GetUserByEmail(ctx, email)
-	if err != nil {
+	// Pre-auth (public /auth/forgot-password): platform sentinel so the email
+	// lookup on FORCE-RLS platform_users can see the user.
+	ctx = tenantctx.WithPlatformScope(ctx)
+	var user *aggregate.PlatformUser
+	if err := s.txRunner.RunInTx(ctx, func(txCtx context.Context) error {
+		u, uerr := s.repo.GetUserByEmail(txCtx, email)
+		if uerr != nil {
+			return uerr
+		}
+		user = u
+		return nil
+	}); err != nil {
 		if errors.Is(err, ErrNotFound) {
 			// Silently succeed to prevent email enumeration.
 			return nil
@@ -198,7 +231,9 @@ func (s *Service) ResetPassword(ctx context.Context, token, newPassword string)
 		return fmt.Errorf("hashing password: %w", err)
 	}
 
-	return s.txRunner.RunInTx(ctx, func(txCtx context.Context) error {
+	// Pre-auth (public /auth/reset-password): platform sentinel so the FOR UPDATE
+	// read on FORCE-RLS platform_users can see the user.
+	return s.txRunner.RunInTx(tenantctx.WithPlatformScope(ctx), func(txCtx context.Context) error {
 		user, err := s.repo.GetUserByIDForUpdate(txCtx, reset.UserID)
 		if err != nil {
 			return fmt.Errorf("finding user: %w", err)
diff --git a/internal/domain/identity/service/identity_service.go b/internal/domain/identity/service/identity_service.go
@@ -191,15 +191,6 @@ type CreateFirstAdminInput struct {
 // Register creates a new user, generates an email verification token, and
 // publishes a UserRegistered event.
 func (s *Service) Register(ctx context.Context, input RegisterInput) (*RegisterResult, error) {
-	// Check for duplicate email.
-	existing, err := s.repo.GetUserByEmail(ctx, input.Email)
-	if err != nil && !errors.Is(err, ErrNotFound) {
-		return nil, fmt.Errorf("checking email: %w", err)
-	}
-	if existing != nil {
-		return nil, ErrEmailTaken
-	}
-
 	now := s.clock.Now()
 	user, err := aggregate.NewPlatformUser(input.Email, input.Password, now)
 	if err != nil {
@@ -211,7 +202,18 @@ func (s *Service) Register(ctx context.Context, input RegisterInput) (*RegisterR
 		return nil, fmt.Errorf("creating email verification: %w", err)
 	}
 
-	if err := s.txRunner.RunInTx(ctx, func(txCtx context.Context) error {
+	// Platform sentinel: the duplicate-email check and CreateUser both touch
+	// identity.platform_users (FORCE RLS); pre-auth registration has no tenant
+	// context, so without it the dup-check is blind (RLS-hidden) and the insert's
+	// scope is undefined. The check runs inside the same tx to close the TOCTOU.
+	if err := s.txRunner.RunInTx(tenantctx.WithPlatformScope(ctx), func(txCtx context.Context) error {
+		existing, cerr := s.repo.GetUserByEmail(txCtx, input.Email)
+		if cerr != nil && !errors.Is(cerr, ErrNotFound) {
+			return fmt.Errorf("checking email: %w", cerr)
+		}
+		if existing != nil {
+			return ErrEmailTaken
+		}
 		if err := s.repo.CreateUser(txCtx, user); err != nil {
 			return fmt.Errorf("persisting user: %w", err)
 		}
@@ -236,8 +238,19 @@ func (s *Service) Register(ctx context.Context, input RegisterInput) (*RegisterR
 // ErrInvalidCredentials for both unknown emails and wrong passwords to avoid
 // leaking user existence.
 func (s *Service) Login(ctx context.Context, input LoginInput) (*LoginResult, error) {
-	user, err := s.repo.GetUserByEmail(ctx, input.Email)
-	if err != nil {
+	// The email lookup reads identity.platform_users, which is FORCE RLS. Login
+	// is pre-auth (no tenant known yet) and must see users across every tenant,
+	// so it runs under the platform sentinel; otherwise the RLS policy hides
+	// every row and login always fails as "invalid credentials".
+	var user *aggregate.PlatformUser
+	if err := s.txRunner.RunInTx(tenantctx.WithPlatformScope(ctx), func(txCtx context.Context) error {
+		u, uerr := s.repo.GetUserByEmail(txCtx, input.Email)
+		if uerr != nil {
+			return uerr
+		}
+		user = u
+		return nil
+	}); err != nil {
 		if errors.Is(err, ErrNotFound) {
 			return nil, ErrInvalidCredentials
 		}
@@ -286,8 +299,19 @@ func (s *Service) RefreshToken(ctx context.Context, refreshToken string) (*Login
 		return nil, ErrSessionExpired
 	}
 
-	user, err := s.repo.GetUserByID(ctx, session.UserID)
-	if err != nil {
+	// GetUserByID reads identity.platform_users (FORCE RLS). Refresh is pre-auth
+	// (the JWT is expired/absent, no tenant scope), so it runs under the platform
+	// sentinel — otherwise RLS hides the user row and every refresh fails,
+	// logging the operator out when the access token expires.
+	var user *aggregate.PlatformUser
+	if err := s.txRunner.RunInTx(tenantctx.WithPlatformScope(ctx), func(txCtx context.Context) error {
+		u, uerr := s.repo.GetUserByID(txCtx, session.UserID)
+		if uerr != nil {
+			return uerr
+		}
+		user = u
+		return nil
+	}); err != nil {
 		return nil, fmt.Errorf("finding user: %w", err)
 	}
 
@@ -339,8 +363,17 @@ func (s *Service) RefreshToken(ctx context.Context, refreshToken string) (*Login
 // SetupNeeded reports whether the platform has no administrator yet, i.e. the
 // first-run admin setup wizard should be shown.
 func (s *Service) SetupNeeded(ctx context.Context) (bool, error) {
-	n, err := s.repo.CountAdmins(ctx)
-	if err != nil {
+	// CountAdmins reads identity.platform_users (FORCE RLS). This is a public,
+	// pre-auth endpoint with no tenant context, so it must run under the platform
+	// sentinel — otherwise RLS hides the admin rows and the count is always 0,
+	// which wrongly reports "setup needed" forever (and traps operators on the
+	// /setup wizard after logout instead of showing /login).
+	var n int64
+	if err := s.txRunner.RunInTx(tenantctx.WithPlatformScope(ctx), func(txCtx context.Context) error {
+		var cerr error
+		n, cerr = s.repo.CountAdmins(txCtx)
+		return cerr
+	}); err != nil {
 		return false, fmt.Errorf("counting admins: %w", err)
 	}
 	return n == 0, nil
@@ -358,7 +391,10 @@ func (s *Service) CreateFirstAdmin(ctx context.Context, in CreateFirstAdminInput
 	}
 
 	var result *LoginResult
-	if err := s.txRunner.RunInTx(ctx, func(txCtx context.Context) error {
+	// Runs under the platform sentinel: CountAdmins / CreateUser touch
+	// identity.platform_users (FORCE RLS), and without it the count would always
+	// see 0 admins (RLS-hidden) and create a duplicate admin on every call.
+	if err := s.txRunner.RunInTx(tenantctx.WithPlatformScope(ctx), func(txCtx context.Context) error {
 		if err := s.repo.AcquireBootstrapLock(txCtx); err != nil {
 			return err
 		}
diff --git a/internal/domain/identity/service_test.go b/internal/domain/identity/service_test.go
@@ -49,10 +49,10 @@ func TestService_Register_Success(t *testing.T) {
 	svc, repo, pub := newTestService(t)
 	ctx := context.Background()
 
-	repo.On("GetUserByEmail", ctx, "alice@example.com").Return(nil, identity.ErrNotFound)
-	repo.On("CreateUser", ctx, mock.AnythingOfType("*aggregate.PlatformUser")).Return(nil)
-	repo.On("CreateEmailVerification", ctx, mock.AnythingOfType("*aggregate.EmailVerification")).Return(nil)
-	pub.On("Publish", ctx, mock.AnythingOfType("domainevent.Event")).Return(nil)
+	repo.On("GetUserByEmail", mock.Anything, "alice@example.com").Return(nil, identity.ErrNotFound)
+	repo.On("CreateUser", mock.Anything, mock.AnythingOfType("*aggregate.PlatformUser")).Return(nil)
+	repo.On("CreateEmailVerification", mock.Anything, mock.AnythingOfType("*aggregate.EmailVerification")).Return(nil)
+	pub.On("Publish", mock.Anything, mock.AnythingOfType("domainevent.Event")).Return(nil)
 
 	result, err := svc.Register(ctx, identity.RegisterInput{
 		Email:    "alice@example.com",
@@ -72,7 +72,7 @@ func TestService_Register_DuplicateEmail(t *testing.T) {
 	ctx := context.Background()
 
 	existing := &identity.PlatformUser{ID: "existing-id", Email: "alice@example.com"}
-	repo.On("GetUserByEmail", ctx, "alice@example.com").Return(existing, nil)
+	repo.On("GetUserByEmail", mock.Anything, "alice@example.com").Return(existing, nil)
 
 	_, err := svc.Register(ctx, identity.RegisterInput{
 		Email:    "alice@example.com",
@@ -96,9 +96,9 @@ func TestService_Login_Success(t *testing.T) {
 		Role:          identity.RoleCustomer,
 	}
 
-	repo.On("GetUserByEmail", ctx, "alice@example.com").Return(user, nil)
-	repo.On("CreateSession", ctx, mock.AnythingOfType("*aggregate.Session")).Return(nil)
-	pub.On("Publish", ctx, mock.AnythingOfType("domainevent.Event")).Return(nil)
+	repo.On("GetUserByEmail", mock.Anything, "alice@example.com").Return(user, nil)
+	repo.On("CreateSession", mock.Anything, mock.AnythingOfType("*aggregate.Session")).Return(nil)
+	pub.On("Publish", mock.Anything, mock.AnythingOfType("domainevent.Event")).Return(nil)
 
 	result, err := svc.Login(ctx, identity.LoginInput{
 		Email:    "alice@example.com",
@@ -126,7 +126,7 @@ func TestService_Login_WrongPassword(t *testing.T) {
 		Role:          identity.RoleCustomer,
 	}
 
-	repo.On("GetUserByEmail", ctx, "alice@example.com").Return(user, nil)
+	repo.On("GetUserByEmail", mock.Anything, "alice@example.com").Return(user, nil)
 
 	_, err := svc.Login(ctx, identity.LoginInput{
 		Email:    "alice@example.com",
@@ -140,7 +140,7 @@ func TestService_Login_UserNotFound(t *testing.T) {
 	svc, repo, _ := newTestService(t)
 	ctx := context.Background()
 
-	repo.On("GetUserByEmail", ctx, "unknown@example.com").Return(nil, identity.ErrNotFound)
+	repo.On("GetUserByEmail", mock.Anything, "unknown@example.com").Return(nil, identity.ErrNotFound)
 
 	_, err := svc.Login(ctx, identity.LoginInput{
 		Email:    "unknown@example.com",
@@ -155,12 +155,12 @@ func TestService_SetupNeeded(t *testing.T) {
 	svc, repo, _ := newTestService(t)
 	ctx := context.Background()
 
-	repo.On("CountAdmins", ctx).Return(int64(0), nil).Once()
+	repo.On("CountAdmins", mock.Anything).Return(int64(0), nil).Once()
 	need, err := svc.SetupNeeded(ctx)
 	require.NoError(t, err)
 	assert.True(t, need)
 
-	repo.On("CountAdmins", ctx).Return(int64(1), nil).Once()
+	repo.On("CountAdmins", mock.Anything).Return(int64(1), nil).Once()
 	need, err = svc.SetupNeeded(ctx)
 	require.NoError(t, err)
 	assert.False(t, need)
@@ -238,11 +238,11 @@ func TestService_VerifyEmail_Success(t *testing.T) {
 		EmailVerified: false,
 	}
 
-	repo.On("GetEmailVerification", ctx, "abc123").Return(verification, nil)
-	repo.On("GetUserByIDForUpdate", ctx, "user-1").Return(user, nil)
-	repo.On("UpdateUser", ctx, mock.AnythingOfType("*aggregate.PlatformUser")).Return(nil)
-	repo.On("DeleteEmailVerification", ctx, "v-1").Return(nil)
-	pub.On("Publish", ctx, mock.AnythingOfType("domainevent.Event")).Return(nil)
+	repo.On("GetEmailVerification", mock.Anything, "abc123").Return(verification, nil)
+	repo.On("GetUserByIDForUpdate", mock.Anything, "user-1").Return(user, nil)
+	repo.On("UpdateUser", mock.Anything, mock.AnythingOfType("*aggregate.PlatformUser")).Return(nil)
+	repo.On("DeleteEmailVerification", mock.Anything, "v-1").Return(nil)
+	pub.On("Publish", mock.Anything, mock.AnythingOfType("domainevent.Event")).Return(nil)
 
 	err := svc.VerifyEmail(ctx, "abc123")
 
@@ -263,7 +263,7 @@ func TestService_VerifyEmail_Expired(t *testing.T) {
 		ExpiresAt: time.Now().Add(-time.Hour), // expired
 	}
 
-	repo.On("GetEmailVerification", ctx, "abc123").Return(verification, nil)
+	repo.On("GetEmailVerification", mock.Anything, "abc123").Return(verification, nil)
 
 	err := svc.VerifyEmail(ctx, "abc123")
 
@@ -352,7 +352,7 @@ func TestService_RefreshToken_Expired(t *testing.T) {
 		ExpiresAt:    time.Now().Add(-time.Hour), // expired
 	}
 
-	repo.On("GetSessionByRefreshToken", ctx, "old-refresh-token").Return(session, nil)
+	repo.On("GetSessionByRefreshToken", mock.Anything, "old-refresh-token").Return(session, nil)
 
 	_, err := svc.RefreshToken(ctx, "old-refresh-token")
 
diff --git a/scripts/first-deploy.sh b/scripts/first-deploy.sh
@@ -167,31 +167,9 @@ until curl -sf http://localhost:80/healthz > /dev/null 2>&1; do
 done
 ok "Health check passed"
 
-# ── Step 8: Create admin account ───────────────────────────────────────────
-ADMIN_EMAIL="admin@remnacore.local"
-ADMIN_CHECK=$(docker compose exec -T platform-db psql -U platform -d remnacore -tAc \
-    "SELECT 1 FROM identity.platform_users WHERE email = '${ADMIN_EMAIL}'" 2>/dev/null || true)
-
-if [ "$ADMIN_CHECK" = "1" ]; then
-    warn "Admin account already exists (${ADMIN_EMAIL}), skipping"
-    ADMIN_PASSWORD="<already created>"
-else
-    ADMIN_PASSWORD="$(rand_secret 24)"
-    # Register via API
-    REGISTER_RESULT=$(curl -sf -X POST http://localhost:80/api/auth/register \
-        -H "Content-Type: application/json" \
-        -d "{\"email\":\"${ADMIN_EMAIL}\",\"password\":\"${ADMIN_PASSWORD}\"}" 2>/dev/null || true)
-
-    if [ -z "$REGISTER_RESULT" ]; then
-        fail "Failed to register admin account"
-    fi
-
-    # Promote to admin role
-    docker compose exec -T platform-db psql -U platform -d remnacore \
-        -c "UPDATE identity.platform_users SET role = 'admin', email_verified = true WHERE email = '${ADMIN_EMAIL}';" > /dev/null 2>&1
-
-    ok "Admin account created"
-fi
+# The first administrator is NOT created here — open the Admin panel and the
+# first-run setup wizard will prompt you to create it (POST /api/setup). The
+# wizard is reachable only while no admin exists and bounces to /login after.
 
 # ── Done ───────────────────────────────────────────────────────────────────
 SERVER_IP=$(hostname -I 2>/dev/null | awk '{print $1}' || echo "localhost")
@@ -205,16 +183,13 @@ echo "  Remnawave panel: http://${SERVER_IP}:8080"
 echo "  API:             http://${SERVER_IP}:80/api"
 echo "  Metrics:         http://${SERVER_IP}:80/metrics"
 echo ""
-if [ "$ADMIN_PASSWORD" != "<already created>" ]; then
-    echo -e "${GREEN}  Admin credentials:${NC}"
-    echo "    Email:    ${ADMIN_EMAIL}"
-    echo "    Password: ${ADMIN_PASSWORD}"
-    echo ""
-    echo "  ⚠  Save these credentials — they will not be shown again."
-fi
+echo -e "${GREEN}  First-run setup:${NC}"
+echo "    Open the Admin panel and create your administrator account"
+echo "    (the setup wizard appears automatically on first launch)."
 echo ""
 echo -e "${YELLOW}ACTION REQUIRED:${NC}"
-echo "  1. Open Remnawave panel at http://${SERVER_IP}:8080"
-echo "  2. Create an API token in the panel"
-echo "  3. Edit .env and set REMNAWAVE_API_TOKEN=<your-token>"
-echo "  4. Run: docker compose restart remnacore"
+echo "  1. Open the Admin panel at http://${SERVER_IP}:8081 and create the admin"
+echo "  2. Open Remnawave panel at http://${SERVER_IP}:8080"
+echo "  3. Create an API token in the Remnawave panel"
+echo "  4. Edit .env and set REMNAWAVE_API_TOKEN=<your-token>"
+echo "  5. Run: docker compose restart remnacore"
