refactor(store): wave B.8 — identity_provider repo (read side) (#259) (#260)

PaulDotterer · web-flow · commit d4c72f159753 · 2026-05-15T23:14:01.000+02:00
* refactor(store): wave B.8 — identity_provider repo (read side) (#259) IdentityProviderRepo covers the read side of the identity-providers projection: Get / GetBySlug / GetBySlugForSCIM / List / Count / ListEnabled. All 17 handler/scim/idp-internal read sites migrated. ClientSecretEncrypted stays encrypted at the boundary; the handler decrypts via internal/crypto when initiating the OIDC dance. ScimTokenHash is surfaced because the SCIM auth handler validates incoming bearer tokens against this column. Field renames at the type boundary follow Go convention: IssuerUrl → IssuerURL, AuthorizationUrl → AuthorizationURL, etc. Propagated to all consumers including sso_handler's OIDC provider config and idpToProto. Call sites migrated (17): - internal/api/idp_handler.go (13) + idpToProto signature - internal/api/sso_handler.go (3) + URL field renames - internal/scim/auth.go (1) - internal/idp/linker.go — LinkOrCreate signature shifted to store.IdentityProvider (callers in api/sso updated accordingly) - internal/idp/linker_test.go — test fixtures use store.IdentityProvider Non-goals: - Write-side projector queries (Insert/Update/SetSCIMEnabled/ RotateSCIMToken) stay on Queries() per the established pattern; pure projector internals migrate in a later wave. - SCIM user/group mapping queries — separate SCIM-domain sub-wave. Closes #259. * fix(scim): align provider context type with new IdentityProvider repo The withAuth middleware now stores store.IdentityProvider in context but providerFromContext was still asserting db.IdentityProvidersProjection, so every authenticated SCIM request failed the type assertion and the handlers downstream returned 401. Swap the context cast and every downstream helper that takes the provider to use store.IdentityProvider. Field accesses (ID, Slug, Name, DefaultRoleID, AutoLinkByEmail, ScimTokenHash) are identical between the two types so no further site changes are needed.
diff --git a/internal/api/idp_handler.go b/internal/api/idp_handler.go
@@ -18,7 +18,6 @@ import (
 	"github.com/manchtools/power-manage/server/internal/eventtypes/payloads"
 	"github.com/manchtools/power-manage/server/internal/middleware"
 	"github.com/manchtools/power-manage/server/internal/store"
-	db "github.com/manchtools/power-manage/server/internal/store/generated"
 )
 
 // IDPHandler handles identity provider CRUD RPCs.
@@ -46,7 +45,7 @@ func (h *IDPHandler) CreateIdentityProvider(ctx context.Context, req *connect.Re
 	}
 
 	// Check for duplicate slug
-	_, err = h.store.Queries().GetIdentityProviderBySlug(ctx, req.Msg.Slug)
+	_, err = h.store.Repos().IdentityProvider.GetBySlug(ctx, req.Msg.Slug)
 	if err == nil {
 		return nil, apiErrorCtx(ctx, ErrProviderSlugExists, connect.CodeAlreadyExists, "provider with this slug already exists")
 	}
@@ -91,7 +90,7 @@ func (h *IDPHandler) CreateIdentityProvider(ctx context.Context, req *connect.Re
 		return nil, err
 	}
 
-	provider, err := h.store.Queries().GetIdentityProviderByID(ctx, id)
+	provider, err := h.store.Repos().IdentityProvider.Get(ctx, id)
 	if err != nil {
 		return nil, apiErrorCtx(ctx, ErrInternal, connect.CodeInternal, "failed to read back provider")
 	}
@@ -107,7 +106,7 @@ func (h *IDPHandler) GetIdentityProvider(ctx context.Context, req *connect.Reque
 		return nil, err
 	}
 
-	provider, err := h.store.Queries().GetIdentityProviderByID(ctx, req.Msg.Id)
+	provider, err := h.store.Repos().IdentityProvider.Get(ctx, req.Msg.Id)
 	if err != nil {
 		return nil, handleGetError(ctx, err, ErrProviderNotFound, "provider not found")
 	}
@@ -124,15 +123,15 @@ func (h *IDPHandler) ListIdentityProviders(ctx context.Context, req *connect.Req
 		return nil, err
 	}
 
-	providers, err := h.store.Queries().ListIdentityProviders(ctx, db.ListIdentityProvidersParams{
+	providers, err := h.store.Repos().IdentityProvider.List(ctx, store.ListIdentityProvidersFilter{
 		Limit:  pageSize,
 		Offset: offset,
 	})
 	if err != nil {
 		return nil, apiErrorCtx(ctx, ErrInternal, connect.CodeInternal, "failed to list providers")
 	}
 
-	count, err := h.store.Queries().CountIdentityProviders(ctx)
+	count, err := h.store.Repos().IdentityProvider.Count(ctx)
 	if err != nil {
 		return nil, apiErrorCtx(ctx, ErrInternal, connect.CodeInternal, "failed to count providers")
 	}
@@ -163,7 +162,7 @@ func (h *IDPHandler) UpdateIdentityProvider(ctx context.Context, req *connect.Re
 	}
 
 	// Verify provider exists
-	_, err = h.store.Queries().GetIdentityProviderByID(ctx, req.Msg.Id)
+	_, err = h.store.Repos().IdentityProvider.Get(ctx, req.Msg.Id)
 	if err != nil {
 		return nil, handleGetError(ctx, err, ErrProviderNotFound, "provider not found")
 	}
@@ -216,7 +215,7 @@ func (h *IDPHandler) UpdateIdentityProvider(ctx context.Context, req *connect.Re
 		return nil, err
 	}
 
-	provider, err := h.store.Queries().GetIdentityProviderByID(ctx, req.Msg.Id)
+	provider, err := h.store.Repos().IdentityProvider.Get(ctx, req.Msg.Id)
 	if err != nil {
 		return nil, apiErrorCtx(ctx, ErrInternal, connect.CodeInternal, "failed to read back provider")
 	}
@@ -321,7 +320,7 @@ func (h *IDPHandler) EnableSCIM(ctx context.Context, req *connect.Request[pm.Ena
 		return nil, err
 	}
 
-	provider, err := h.store.Queries().GetIdentityProviderByID(ctx, req.Msg.Id)
+	provider, err := h.store.Repos().IdentityProvider.Get(ctx, req.Msg.Id)
 	if err != nil {
 		return nil, handleGetError(ctx, err, ErrProviderNotFound, "provider not found")
 	}
@@ -374,7 +373,7 @@ func (h *IDPHandler) DisableSCIM(ctx context.Context, req *connect.Request[pm.Di
 		return nil, err
 	}
 
-	provider, err := h.store.Queries().GetIdentityProviderByID(ctx, req.Msg.Id)
+	provider, err := h.store.Repos().IdentityProvider.Get(ctx, req.Msg.Id)
 	if err != nil {
 		return nil, handleGetError(ctx, err, ErrProviderNotFound, "provider not found")
 	}
@@ -408,7 +407,7 @@ func (h *IDPHandler) RotateSCIMToken(ctx context.Context, req *connect.Request[p
 		return nil, err
 	}
 
-	provider, err := h.store.Queries().GetIdentityProviderByID(ctx, req.Msg.Id)
+	provider, err := h.store.Repos().IdentityProvider.Get(ctx, req.Msg.Id)
 	if err != nil {
 		return nil, handleGetError(ctx, err, ErrProviderNotFound, "provider not found")
 	}
@@ -449,18 +448,18 @@ func (h *IDPHandler) RotateSCIMToken(ctx context.Context, req *connect.Request[p
 
 // idpToProto converts a database identity provider to a proto message.
 // Note: client_secret is never returned to the client.
-func (h *IDPHandler) idpToProto(p db.IdentityProvidersProjection) *pm.IdentityProvider {
+func (h *IDPHandler) idpToProto(p store.IdentityProvider) *pm.IdentityProvider {
 	provider := &pm.IdentityProvider{
 		Id:                       p.ID,
 		Name:                     p.Name,
 		Slug:                     p.Slug,
 		ProviderType:             identityProviderTypeFromString(p.ProviderType),
 		Enabled:                  p.Enabled,
 		ClientId:                 p.ClientID,
-		IssuerUrl:                p.IssuerUrl,
-		AuthorizationUrl:         p.AuthorizationUrl,
-		TokenUrl:                 p.TokenUrl,
-		UserinfoUrl:              p.UserinfoUrl,
+		IssuerUrl:                p.IssuerURL,
+		AuthorizationUrl:         p.AuthorizationURL,
+		TokenUrl:                 p.TokenURL,
+		UserinfoUrl:              p.UserinfoURL,
 		Scopes:                   p.Scopes,
 		AutoCreateUsers:          p.AutoCreateUsers,
 		AutoLinkByEmail:          p.AutoLinkByEmail,
diff --git a/internal/api/sso_handler.go b/internal/api/sso_handler.go
@@ -82,7 +82,7 @@ func (h *SSOHandler) ListAuthMethods(ctx context.Context, req *connect.Request[p
 	}
 
 	// List enabled providers
-	providers, err := h.store.Queries().ListEnabledIdentityProviders(ctx)
+	providers, err := h.store.Repos().IdentityProvider.ListEnabled(ctx)
 	if err == nil {
 		for _, p := range providers {
 			resp.Providers = append(resp.Providers, &pm.AuthMethodProvider{
@@ -104,7 +104,7 @@ func (h *SSOHandler) GetSSOLoginURL(ctx context.Context, req *connect.Request[pm
 		return nil, err
 	}
 
-	provider, err := h.store.Queries().GetIdentityProviderBySlug(ctx, req.Msg.Slug)
+	provider, err := h.store.Repos().IdentityProvider.GetBySlug(ctx, req.Msg.Slug)
 	if err != nil {
 		return nil, handleGetError(ctx, err, ErrProviderNotFound, "provider not found")
 	}
@@ -159,10 +159,10 @@ func (h *SSOHandler) GetSSOLoginURL(ctx context.Context, req *connect.Request[pm
 		callbackURL = h.callbackBaseURL + "/auth/callback/" + provider.Slug
 	}
 	oidcProvider, err := idp.NewOIDCProvider(ctx, idp.ProviderConfig{
-		IssuerURL:        provider.IssuerUrl,
-		AuthorizationURL: provider.AuthorizationUrl,
-		TokenURL:         provider.TokenUrl,
-		UserinfoURL:      provider.UserinfoUrl,
+		IssuerURL:        provider.IssuerURL,
+		AuthorizationURL: provider.AuthorizationURL,
+		TokenURL:         provider.TokenURL,
+		UserinfoURL:      provider.UserinfoURL,
 		ClientID:         provider.ClientID,
 		ClientSecret:     clientSecret,
 		Scopes:           provider.Scopes,
@@ -204,7 +204,7 @@ func (h *SSOHandler) SSOCallback(ctx context.Context, req *connect.Request[pm.SS
 	}
 
 	// Get provider
-	provider, err := h.store.Queries().GetIdentityProviderByID(ctx, authState.ProviderID)
+	provider, err := h.store.Repos().IdentityProvider.Get(ctx, authState.ProviderID)
 	if err != nil {
 		return nil, apiErrorCtx(ctx, ErrInternal, connect.CodeInternal, "failed to get provider")
 	}
@@ -232,10 +232,10 @@ func (h *SSOHandler) SSOCallback(ctx context.Context, req *connect.Request[pm.SS
 		callbackURL = h.callbackBaseURL + "/auth/callback/" + provider.Slug
 	}
 	oidcProvider, err := idp.NewOIDCProvider(ctx, idp.ProviderConfig{
-		IssuerURL:        provider.IssuerUrl,
-		AuthorizationURL: provider.AuthorizationUrl,
-		TokenURL:         provider.TokenUrl,
-		UserinfoURL:      provider.UserinfoUrl,
+		IssuerURL:        provider.IssuerURL,
+		AuthorizationURL: provider.AuthorizationURL,
+		TokenURL:         provider.TokenURL,
+		UserinfoURL:      provider.UserinfoURL,
 		ClientID:         provider.ClientID,
 		ClientSecret:     clientSecret,
 		Scopes:           provider.Scopes,
diff --git a/internal/idp/linker.go b/internal/idp/linker.go
@@ -75,7 +75,7 @@ func NewLinker(queries Querier, appender EventAppender) *Linker {
 // 2. If auto_link_by_email: find user by email → create link, return user
 // 3. If auto_create_users: create user (no password), assign default role, create link
 // 4. Otherwise: error
-func (l *Linker) LinkOrCreate(ctx context.Context, provider db.IdentityProvidersProjection, claims *UserClaims) (*LinkResult, error) {
+func (l *Linker) LinkOrCreate(ctx context.Context, provider store.IdentityProvider, claims *UserClaims) (*LinkResult, error) {
 	slog.Debug("SSO linker: starting LinkOrCreate",
 		"provider_id", provider.ID,
 		"provider_slug", provider.Slug,
diff --git a/internal/idp/linker_test.go b/internal/idp/linker_test.go
@@ -53,7 +53,7 @@ func TestLinkOrCreate_AutoCreateUserIncludesLinuxFields(t *testing.T) {
 	appender := &mockAppender{}
 	linker := NewLinker(querier, appender)
 
-	provider := db.IdentityProvidersProjection{
+	provider := store.IdentityProvider{
 		ID:              "provider-1",
 		Slug:            "test-idp",
 		AutoCreateUsers: true,
@@ -105,7 +105,7 @@ func TestLinkOrCreate_AutoCreateUserDeriveUsernameFromEmail(t *testing.T) {
 	appender := &mockAppender{}
 	linker := NewLinker(querier, appender)
 
-	provider := db.IdentityProvidersProjection{
+	provider := store.IdentityProvider{
 		ID:              "provider-2",
 		Slug:            "test-idp",
 		AutoCreateUsers: true,
diff --git a/internal/scim/auth.go b/internal/scim/auth.go
@@ -8,7 +8,6 @@ import (
 	"golang.org/x/crypto/bcrypt"
 
 	"github.com/manchtools/power-manage/server/internal/store"
-	db "github.com/manchtools/power-manage/server/internal/store/generated"
 )
 
 // withAuth wraps a handler with SCIM bearer token authentication.
@@ -56,7 +55,7 @@ func (h *Handler) withAuth(next http.HandlerFunc) http.HandlerFunc {
 		}
 
 		// Look up provider by slug with SCIM enabled
-		provider, err := h.store.Queries().GetIdentityProviderBySlugForSCIM(r.Context(), slug)
+		provider, err := h.store.Repos().IdentityProvider.GetBySlugForSCIM(r.Context(), slug)
 		if err != nil {
 			if store.IsNotFound(err) {
 				h.logger.Warn("SCIM auth failed: unknown provider or SCIM not enabled", "slug", slug)
@@ -98,7 +97,7 @@ func (h *Handler) withAuth(next http.HandlerFunc) http.HandlerFunc {
 }
 
 // providerFromContext extracts the authenticated identity provider from the context.
-func providerFromContext(ctx context.Context) (db.IdentityProvidersProjection, bool) {
-	provider, ok := ctx.Value(providerContextKey).(db.IdentityProvidersProjection)
+func providerFromContext(ctx context.Context) (store.IdentityProvider, bool) {
+	provider, ok := ctx.Value(providerContextKey).(store.IdentityProvider)
 	return provider, ok
 }
diff --git a/internal/scim/groups.go b/internal/scim/groups.go
@@ -63,7 +63,7 @@ func (h *Handler) listGroups(w http.ResponseWriter, r *http.Request) {
 }
 
 // listGroupsFiltered handles filtered group list requests.
-func (h *Handler) listGroupsFiltered(w http.ResponseWriter, r *http.Request, provider db.IdentityProvidersProjection, filterStr string, startIndex int, baseURL string) {
+func (h *Handler) listGroupsFiltered(w http.ResponseWriter, r *http.Request, provider store.IdentityProvider, filterStr string, startIndex int, baseURL string) {
 	f, err := parseFilter(filterStr)
 	if err != nil {
 		writeError(w, http.StatusBadRequest, fmt.Sprintf("invalid filter: %s", err))
diff --git a/internal/scim/groups_helpers.go b/internal/scim/groups_helpers.go
@@ -19,7 +19,7 @@ import (
 // current member set and emits per-user UserGroupMemberAdded /
 // UserGroupMemberRemoved events. Idempotent — calling with the same
 // member set twice produces no second-round events.
-func (h *Handler) reconcileGroupMembers(ctx context.Context, provider db.IdentityProvidersProjection, groupID string, requestedMembers []SCIMMember) {
+func (h *Handler) reconcileGroupMembers(ctx context.Context, provider store.IdentityProvider, groupID string, requestedMembers []SCIMMember) {
 	h.logger.Debug("SCIM reconcileGroupMembers", "group_id", groupID, "requested_count", len(requestedMembers))
 	currentMemberIDs, err := h.store.Queries().ListUserGroupMemberIDs(ctx, groupID)
 	if err != nil {
diff --git a/internal/scim/groups_mutate.go b/internal/scim/groups_mutate.go
@@ -192,7 +192,7 @@ func (h *Handler) patchGroup(w http.ResponseWriter, r *http.Request) {
 }
 
 // handleGroupPatchAdd processes an "add" patch operation on a group.
-func (h *Handler) handleGroupPatchAdd(ctx context.Context, provider db.IdentityProvidersProjection, groupID string, op SCIMPatchOp) {
+func (h *Handler) handleGroupPatchAdd(ctx context.Context, provider store.IdentityProvider, groupID string, op SCIMPatchOp) {
 	path := strings.ToLower(op.Path)
 	if path != "members" && path != "" {
 		return
@@ -216,7 +216,7 @@ func (h *Handler) handleGroupPatchAdd(ctx context.Context, provider db.IdentityP
 }
 
 // handleGroupPatchRemove processes a "remove" patch operation on a group.
-func (h *Handler) handleGroupPatchRemove(ctx context.Context, provider db.IdentityProvidersProjection, groupID string, op SCIMPatchOp) {
+func (h *Handler) handleGroupPatchRemove(ctx context.Context, provider store.IdentityProvider, groupID string, op SCIMPatchOp) {
 	path := strings.ToLower(op.Path)
 
 	// Handle path like: members[value eq "userId"]
@@ -261,7 +261,7 @@ func (h *Handler) handleGroupPatchRemove(ctx context.Context, provider db.Identi
 }
 
 // handleGroupPatchReplace processes a "replace" patch operation on a group.
-func (h *Handler) handleGroupPatchReplace(ctx context.Context, provider db.IdentityProvidersProjection, groupID string, mapping db.ScimGroupMappingProjection, op SCIMPatchOp) {
+func (h *Handler) handleGroupPatchReplace(ctx context.Context, provider store.IdentityProvider, groupID string, mapping db.ScimGroupMappingProjection, op SCIMPatchOp) {
 	path := strings.ToLower(op.Path)
 
 	switch path {
diff --git a/internal/scim/users.go b/internal/scim/users.go
@@ -88,7 +88,7 @@ func (h *Handler) listUsers(w http.ResponseWriter, r *http.Request) {
 }
 
 // listUsersFiltered handles filtered user list requests.
-func (h *Handler) listUsersFiltered(w http.ResponseWriter, r *http.Request, provider db.IdentityProvidersProjection, filterStr string, startIndex, count int, baseURL string) {
+func (h *Handler) listUsersFiltered(w http.ResponseWriter, r *http.Request, provider store.IdentityProvider, filterStr string, startIndex, count int, baseURL string) {
 	f, err := parseFilter(filterStr)
 	if err != nil {
 		writeError(w, http.StatusBadRequest, fmt.Sprintf("invalid filter: %s", err))
diff --git a/internal/scim/users_helpers.go b/internal/scim/users_helpers.go
@@ -31,7 +31,7 @@ func newULID() string {
 
 // syncUserFromSCIM syncs email, active status, profile, and identity link data from SCIM.
 // SCIM is treated as the source of truth — any differences are overwritten.
-func (h *Handler) syncUserFromSCIM(ctx context.Context, provider db.IdentityProvidersProjection, userID, email string, active *bool, name *SCIMName) {
+func (h *Handler) syncUserFromSCIM(ctx context.Context, provider store.IdentityProvider, userID, email string, active *bool, name *SCIMName) {
 	user, err := h.store.Queries().GetUserByID(ctx, userID)
 	if err != nil {
 		h.logger.Error("failed to get user for SCIM sync", "user_id", userID, "error", err)
@@ -97,7 +97,7 @@ func (h *Handler) syncUserFromSCIM(ctx context.Context, provider db.IdentityProv
 
 // syncIdentityLink updates the identity link's external_email and external_name
 // to reflect the latest data from the SCIM provider (source of truth).
-func (h *Handler) syncIdentityLink(ctx context.Context, provider db.IdentityProvidersProjection, userID, email string, name *SCIMName) {
+func (h *Handler) syncIdentityLink(ctx context.Context, provider store.IdentityProvider, userID, email string, name *SCIMName) {
 	link, err := h.store.Queries().GetIdentityLinkByProviderAndUser(ctx, db.GetIdentityLinkByProviderAndUserParams{
 		ProviderID: provider.ID,
 		UserID:     userID,
diff --git a/internal/scim/users_mutate.go b/internal/scim/users_mutate.go
@@ -251,7 +251,7 @@ func (h *Handler) patchUser(w http.ResponseWriter, r *http.Request) {
 }
 
 // handleUserPatchReplace processes a single "replace" patch operation on a user.
-func (h *Handler) handleUserPatchReplace(ctx context.Context, provider db.IdentityProvidersProjection, userID string, existingUser db.UsersProjection, op SCIMPatchOp) error {
+func (h *Handler) handleUserPatchReplace(ctx context.Context, provider store.IdentityProvider, userID string, existingUser db.UsersProjection, op SCIMPatchOp) error {
 	path := strings.ToLower(op.Path)
 
 	switch path {
diff --git a/internal/store/identity_provider.go b/internal/store/identity_provider.go
@@ -0,0 +1,79 @@
+package store
+
+import (
+	"context"
+	"encoding/json"
+	"time"
+)
+
+// IdentityProvider is the per-provider OIDC/SSO configuration row.
+// ClientSecretEncrypted stays encrypted at the boundary; the handler
+// decrypts via internal/crypto when initiating the OIDC dance.
+//
+// ScimTokenHash is the bcrypt hash of the SCIM bearer token —
+// surfaced here because the SCIM auth handler validates incoming
+// bearer tokens against this column. Treat with the same care as
+// ClientSecretEncrypted (don't log; don't return to clients).
+type IdentityProvider struct {
+	ID                       string
+	Name                     string
+	Slug                     string
+	ProviderType             string
+	Enabled                  bool
+	ClientID                 string
+	ClientSecretEncrypted    string
+	IssuerURL                string
+	AuthorizationURL         string
+	TokenURL                 string
+	UserinfoURL              string
+	Scopes                   []string
+	AutoCreateUsers          bool
+	AutoLinkByEmail          bool
+	DefaultRoleID            string
+	AttributeMapping         json.RawMessage
+	DisablePasswordForLinked bool
+	GroupClaim               string
+	GroupMapping             json.RawMessage
+	CreatedAt                time.Time
+	CreatedBy                string
+	UpdatedAt                time.Time
+	ScimEnabled              bool
+	ScimTokenHash            string
+}
+
+// ListIdentityProvidersFilter is the pagination shape for the
+// provider list endpoint.
+type ListIdentityProvidersFilter struct {
+	Limit  int32
+	Offset int32
+}
+
+// IdentityProviderRepo reads the identity-provider configuration
+// projection. Writes (IdentityProviderCreated / Updated / SCIMEnabled /
+// SCIMTokenRotated) flow through the event store + projector — the
+// projector's listener writes are NOT covered by this repo.
+type IdentityProviderRepo interface {
+	// Get returns the provider with the given ID. Returns ErrNotFound
+	// when no such provider exists.
+	Get(ctx context.Context, id string) (IdentityProvider, error)
+
+	// GetBySlug returns the provider with the given slug. Returns
+	// ErrNotFound for unknown slugs.
+	GetBySlug(ctx context.Context, slug string) (IdentityProvider, error)
+
+	// GetBySlugForSCIM returns the provider by slug, restricted to
+	// SCIM-enabled providers. Returns ErrNotFound when the provider
+	// is unknown OR SCIM is disabled — the SCIM auth handler maps
+	// both to 401 without distinguishing.
+	GetBySlugForSCIM(ctx context.Context, slug string) (IdentityProvider, error)
+
+	// List returns a page of providers.
+	List(ctx context.Context, filter ListIdentityProvidersFilter) ([]IdentityProvider, error)
+
+	// Count returns the total number of non-deleted providers.
+	Count(ctx context.Context) (int64, error)
+
+	// ListEnabled returns every non-deleted, enabled provider. Used
+	// by the login UI to populate the SSO button list.
+	ListEnabled(ctx context.Context) ([]IdentityProvider, error)
+}
diff --git a/internal/store/postgres/identity_provider.go b/internal/store/postgres/identity_provider.go
diff --git a/internal/store/postgres/wire.go b/internal/store/postgres/wire.go
diff --git a/internal/store/repos.go b/internal/store/repos.go

Original file line number	Diff line number	Diff line change
`@@ -18,7 +18,6 @@ import (`
`18`	`18`	`"github.com/manchtools/power-manage/server/internal/eventtypes/payloads"`
`19`	`19`	`"github.com/manchtools/power-manage/server/internal/middleware"`
`20`	`20`	`"github.com/manchtools/power-manage/server/internal/store"`
`21`		`- db "github.com/manchtools/power-manage/server/internal/store/generated"`
`22`	`21`	`)`
`23`	`22`
`24`	`23`	`// IDPHandler handles identity provider CRUD RPCs.`
`@@ -46,7 +45,7 @@ func (h IDPHandler) CreateIdentityProvider(ctx context.Context, req connect.Re`
`46`	`45`	`}`
`47`	`46`
`48`	`47`	`// Check for duplicate slug`
`49`		`- _, err = h.store.Queries().GetIdentityProviderBySlug(ctx, req.Msg.Slug)`
	`48`	`+ _, err = h.store.Repos().IdentityProvider.GetBySlug(ctx, req.Msg.Slug)`
`50`	`49`	`if err == nil {`
`51`	`50`	`return nil, apiErrorCtx(ctx, ErrProviderSlugExists, connect.CodeAlreadyExists, "provider with this slug already exists")`
`52`	`51`	`}`
`@@ -91,7 +90,7 @@ func (h IDPHandler) CreateIdentityProvider(ctx context.Context, req connect.Re`
`91`	`90`	`return nil, err`
`92`	`91`	`}`
`93`	`92`
`94`		`- provider, err := h.store.Queries().GetIdentityProviderByID(ctx, id)`
	`93`	`+ provider, err := h.store.Repos().IdentityProvider.Get(ctx, id)`
`95`	`94`	`if err != nil {`
`96`	`95`	`return nil, apiErrorCtx(ctx, ErrInternal, connect.CodeInternal, "failed to read back provider")`
`97`	`96`	`}`
`@@ -107,7 +106,7 @@ func (h IDPHandler) GetIdentityProvider(ctx context.Context, req connect.Reque`
`107`	`106`	`return nil, err`
`108`	`107`	`}`
`109`	`108`
`110`		`- provider, err := h.store.Queries().GetIdentityProviderByID(ctx, req.Msg.Id)`
	`109`	`+ provider, err := h.store.Repos().IdentityProvider.Get(ctx, req.Msg.Id)`
`111`	`110`	`if err != nil {`
`112`	`111`	`return nil, handleGetError(ctx, err, ErrProviderNotFound, "provider not found")`
`113`	`112`	`}`
`@@ -124,15 +123,15 @@ func (h IDPHandler) ListIdentityProviders(ctx context.Context, req connect.Req`
`124`	`123`	`return nil, err`
`125`	`124`	`}`
`126`	`125`
`127`		`- providers, err := h.store.Queries().ListIdentityProviders(ctx, db.ListIdentityProvidersParams{`
	`126`	`+ providers, err := h.store.Repos().IdentityProvider.List(ctx, store.ListIdentityProvidersFilter{`
`128`	`127`	`Limit: pageSize,`
`129`	`128`	`Offset: offset,`
`130`	`129`	`})`
`131`	`130`	`if err != nil {`
`132`	`131`	`return nil, apiErrorCtx(ctx, ErrInternal, connect.CodeInternal, "failed to list providers")`
`133`	`132`	`}`
`134`	`133`
`135`		`- count, err := h.store.Queries().CountIdentityProviders(ctx)`
	`134`	`+ count, err := h.store.Repos().IdentityProvider.Count(ctx)`
`136`	`135`	`if err != nil {`
`137`	`136`	`return nil, apiErrorCtx(ctx, ErrInternal, connect.CodeInternal, "failed to count providers")`
`138`	`137`	`}`
`@@ -163,7 +162,7 @@ func (h IDPHandler) UpdateIdentityProvider(ctx context.Context, req connect.Re`
`163`	`162`	`}`
`164`	`163`
`165`	`164`	`// Verify provider exists`
`166`		`- _, err = h.store.Queries().GetIdentityProviderByID(ctx, req.Msg.Id)`
	`165`	`+ _, err = h.store.Repos().IdentityProvider.Get(ctx, req.Msg.Id)`
`167`	`166`	`if err != nil {`
`168`	`167`	`return nil, handleGetError(ctx, err, ErrProviderNotFound, "provider not found")`
`169`	`168`	`}`
`@@ -216,7 +215,7 @@ func (h IDPHandler) UpdateIdentityProvider(ctx context.Context, req connect.Re`
`216`	`215`	`return nil, err`
`217`	`216`	`}`
`218`	`217`
`219`		`- provider, err := h.store.Queries().GetIdentityProviderByID(ctx, req.Msg.Id)`
	`218`	`+ provider, err := h.store.Repos().IdentityProvider.Get(ctx, req.Msg.Id)`
`220`	`219`	`if err != nil {`
`221`	`220`	`return nil, apiErrorCtx(ctx, ErrInternal, connect.CodeInternal, "failed to read back provider")`
`222`	`221`	`}`
`@@ -321,7 +320,7 @@ func (h IDPHandler) EnableSCIM(ctx context.Context, req connect.Request[pm.Ena`
`321`	`320`	`return nil, err`
`322`	`321`	`}`
`323`	`322`
`324`		`- provider, err := h.store.Queries().GetIdentityProviderByID(ctx, req.Msg.Id)`
	`323`	`+ provider, err := h.store.Repos().IdentityProvider.Get(ctx, req.Msg.Id)`
`325`	`324`	`if err != nil {`
`326`	`325`	`return nil, handleGetError(ctx, err, ErrProviderNotFound, "provider not found")`
`327`	`326`	`}`
`@@ -374,7 +373,7 @@ func (h IDPHandler) DisableSCIM(ctx context.Context, req connect.Request[pm.Di`
`374`	`373`	`return nil, err`
`375`	`374`	`}`
`376`	`375`
`377`		`- provider, err := h.store.Queries().GetIdentityProviderByID(ctx, req.Msg.Id)`
	`376`	`+ provider, err := h.store.Repos().IdentityProvider.Get(ctx, req.Msg.Id)`
`378`	`377`	`if err != nil {`
`379`	`378`	`return nil, handleGetError(ctx, err, ErrProviderNotFound, "provider not found")`
`380`	`379`	`}`
`@@ -408,7 +407,7 @@ func (h IDPHandler) RotateSCIMToken(ctx context.Context, req connect.Request[p`
`408`	`407`	`return nil, err`
`409`	`408`	`}`
`410`	`409`
`411`		`- provider, err := h.store.Queries().GetIdentityProviderByID(ctx, req.Msg.Id)`
	`410`	`+ provider, err := h.store.Repos().IdentityProvider.Get(ctx, req.Msg.Id)`
`412`	`411`	`if err != nil {`
`413`	`412`	`return nil, handleGetError(ctx, err, ErrProviderNotFound, "provider not found")`
`414`	`413`	`}`
`@@ -449,18 +448,18 @@ func (h IDPHandler) RotateSCIMToken(ctx context.Context, req connect.Request[p`
`449`	`448`
`450`	`449`	`// idpToProto converts a database identity provider to a proto message.`
`451`	`450`	`// Note: client_secret is never returned to the client.`
`452`		`-func (h IDPHandler) idpToProto(p db.IdentityProvidersProjection) pm.IdentityProvider {`
	`451`	`+func (h IDPHandler) idpToProto(p store.IdentityProvider) pm.IdentityProvider {`
`453`	`452`	`provider := &pm.IdentityProvider{`
`454`	`453`	`Id: p.ID,`
`455`	`454`	`Name: p.Name,`
`456`	`455`	`Slug: p.Slug,`
`457`	`456`	`ProviderType: identityProviderTypeFromString(p.ProviderType),`
`458`	`457`	`Enabled: p.Enabled,`
`459`	`458`	`ClientId: p.ClientID,`
`460`		`- IssuerUrl: p.IssuerUrl,`
`461`		`- AuthorizationUrl: p.AuthorizationUrl,`
`462`		`- TokenUrl: p.TokenUrl,`
`463`		`- UserinfoUrl: p.UserinfoUrl,`
	`459`	`+ IssuerUrl: p.IssuerURL,`
	`460`	`+ AuthorizationUrl: p.AuthorizationURL,`
	`461`	`+ TokenUrl: p.TokenURL,`
	`462`	`+ UserinfoUrl: p.UserinfoURL,`
`464`	`463`	`Scopes: p.Scopes,`
`465`	`464`	`AutoCreateUsers: p.AutoCreateUsers,`
`466`	`465`	`AutoLinkByEmail: p.AutoLinkByEmail,`
Original file line number	Diff line number	Diff line change
`@@ -8,7 +8,6 @@ import (`
`8`	`8`	`"golang.org/x/crypto/bcrypt"`
`9`	`9`
`10`	`10`	`"github.com/manchtools/power-manage/server/internal/store"`
`11`		`- db "github.com/manchtools/power-manage/server/internal/store/generated"`
`12`	`11`	`)`
`13`	`12`
`14`	`13`	`// withAuth wraps a handler with SCIM bearer token authentication.`
`@@ -56,7 +55,7 @@ func (h *Handler) withAuth(next http.HandlerFunc) http.HandlerFunc {`
`56`	`55`	`}`
`57`	`56`
`58`	`57`	`// Look up provider by slug with SCIM enabled`
`59`		`- provider, err := h.store.Queries().GetIdentityProviderBySlugForSCIM(r.Context(), slug)`
	`58`	`+ provider, err := h.store.Repos().IdentityProvider.GetBySlugForSCIM(r.Context(), slug)`
`60`	`59`	`if err != nil {`
`61`	`60`	`if store.IsNotFound(err) {`
`62`	`61`	`h.logger.Warn("SCIM auth failed: unknown provider or SCIM not enabled", "slug", slug)`
`@@ -98,7 +97,7 @@ func (h *Handler) withAuth(next http.HandlerFunc) http.HandlerFunc {`
`98`	`97`	`}`
`99`	`98`
`100`	`99`	`// providerFromContext extracts the authenticated identity provider from the context.`
`101`		`-func providerFromContext(ctx context.Context) (db.IdentityProvidersProjection, bool) {`
`102`		`- provider, ok := ctx.Value(providerContextKey).(db.IdentityProvidersProjection)`
	`100`	`+func providerFromContext(ctx context.Context) (store.IdentityProvider, bool) {`
	`101`	`+ provider, ok := ctx.Value(providerContextKey).(store.IdentityProvider)`
`103`	`102`	`return provider, ok`
`104`	`103`	`}`
Original file line number	Diff line number	Diff line change
`@@ -63,7 +63,7 @@ func (h Handler) listGroups(w http.ResponseWriter, r http.Request) {`
`63`	`63`	`}`
`64`	`64`
`65`	`65`	`// listGroupsFiltered handles filtered group list requests.`
`66`		`-func (h Handler) listGroupsFiltered(w http.ResponseWriter, r http.Request, provider db.IdentityProvidersProjection, filterStr string, startIndex int, baseURL string) {`
	`66`	`+func (h Handler) listGroupsFiltered(w http.ResponseWriter, r http.Request, provider store.IdentityProvider, filterStr string, startIndex int, baseURL string) {`
`67`	`67`	`f, err := parseFilter(filterStr)`
`68`	`68`	`if err != nil {`
`69`	`69`	`writeError(w, http.StatusBadRequest, fmt.Sprintf("invalid filter: %s", err))`
Original file line number	Diff line number	Diff line change
`@@ -88,7 +88,7 @@ func (h Handler) listUsers(w http.ResponseWriter, r http.Request) {`
`88`	`88`	`}`
`89`	`89`
`90`	`90`	`// listUsersFiltered handles filtered user list requests.`
`91`		`-func (h Handler) listUsersFiltered(w http.ResponseWriter, r http.Request, provider db.IdentityProvidersProjection, filterStr string, startIndex, count int, baseURL string) {`
	`91`	`+func (h Handler) listUsersFiltered(w http.ResponseWriter, r http.Request, provider store.IdentityProvider, filterStr string, startIndex, count int, baseURL string) {`
`92`	`92`	`f, err := parseFilter(filterStr)`
`93`	`93`	`if err != nil {`
`94`	`94`	`writeError(w, http.StatusBadRequest, fmt.Sprintf("invalid filter: %s", err))`