refactor(store): wave B.12 — user repo (#267)

UserRepo — the biggest single-domain migration. Covers the core
user-projection reads:

  Get / GetByEmail / SessionInfo / Permissions / NextLinuxUID /
  List / Count / ListAllNonDeleted

The narrow SessionInfo shape (Disabled / SessionVersion / IsDeleted)
keeps the hot refresh-token validation path light. Permissions
returns the flattened permission list combining direct role
permissions + user-group inheritance.

Call sites migrated (~70 across 21 files):
- api: user_handler (8), auth_handler (3), sso_handler (2),
  totp_handler (3), settings_handler (2), system_actions (3) +
  test sites, terminal_handler, token_handler, identity_link_handler,
  assignment_handler, user_group_handler
- scim: users, users_create, users_helpers, users_mutate,
  users_translation, handler (interface)
- idp: linker, linker_test
- control: admin_user

Signatures shifted:
- userToProto: db.UsersProjection -> store.User
- userToSCIM: db.UsersProjection -> store.User
- SystemActionsCleaner.CleanupDeletedUserActions: db.UsersProjection
  -> store.User (interface + tests + fake)
- 6 system-action helpers (sync/cleanup user / ssh / tty) +
  systemTtyUserParams

Field rename: LinuxUid (sqlc) -> LinuxUID (domain).
SshPublicKeys stays as json.RawMessage at the boundary per the
JSONB normalize plan in #242.

Closes #267.

Author: PaulDotterer

cmd/control/admin_user.go

@@ -20,7 +20,7 @@ import (
 
 func ensureAdminUser(ctx context.Context, st *store.Store, email, password string, logger *slog.Logger) error {
 	// Check if user exists via the projection
-	_, err := st.Queries().GetUserByEmail(ctx, email)
+	_, err := st.Repos().User.GetByEmail(ctx, email)
 	if err == nil {
 		logger.Info("admin user already exists", "email", email)
 		return nil

internal/api/assignment_handler.go

@@ -97,7 +97,7 @@ func (h *AssignmentHandler) CreateAssignment(ctx context.Context, req *connect.R
 			return nil, apiErrorCtx(ctx, ErrInternal, connect.CodeInternal, "failed to get device group")
 		}
 	case pm.AssignmentTargetType_ASSIGNMENT_TARGET_TYPE_USER:
-		_, err := h.store.Queries().GetUserByID(ctx, req.Msg.TargetId)
+		_, err := h.store.Repos().User.Get(ctx, req.Msg.TargetId)
 		if err != nil {
 			if store.IsNotFound(err) {
 				return nil, apiErrorCtx(ctx, ErrUserNotFound, connect.CodeNotFound, "user not found")

internal/api/auth_handler.go

@@ -52,7 +52,7 @@ func (h *AuthHandler) Login(ctx context.Context, req *connect.Request[pm.LoginRe
 		return nil, apiErrorCtx(ctx, ErrPasswordLoginDisabled, connect.CodeUnauthenticated, "password login is disabled on this server")
 	}
 
-	user, err := h.store.Queries().GetUserByEmail(ctx, req.Msg.Email)
+	user, err := h.store.Repos().User.GetByEmail(ctx, req.Msg.Email)
 	if err != nil {
 		if store.IsNotFound(err) {
 			// Perform a dummy bcrypt comparison to prevent timing-based user enumeration
@@ -94,7 +94,7 @@ func (h *AuthHandler) Login(ctx context.Context, req *connect.Request[pm.LoginRe
 	}
 
 	// Resolve permissions from DB and embed in JWT
-	permissions, err := h.store.Queries().GetUserPermissionsWithGroups(ctx, user.ID)
+	permissions, err := h.store.Repos().User.Permissions(ctx, user.ID)
 	if err != nil {
 		return nil, apiErrorCtx(ctx, ErrInternal, connect.CodeInternal, "failed to resolve permissions")
 	}
@@ -167,7 +167,7 @@ func (h *AuthHandler) RefreshToken(ctx context.Context, req *connect.Request[pm.
 	}
 
 	// Check user status (disabled, deleted) and session version before issuing new tokens
-	info, err := h.store.Queries().GetUserSessionInfo(ctx, result.Claims.UserID)
+	info, err := h.store.Repos().User.SessionInfo(ctx, result.Claims.UserID)
 	if err != nil {
 		return nil, apiErrorCtx(ctx, ErrUserNotFound, connect.CodeUnauthenticated, "user not found")
 	}
@@ -191,7 +191,7 @@ func (h *AuthHandler) RefreshToken(ctx context.Context, req *connect.Request[pm.
 	}
 
 	// Resolve fresh permissions from DB
-	permissions, err := h.store.Queries().GetUserPermissionsWithGroups(ctx, result.Claims.UserID)
+	permissions, err := h.store.Repos().User.Permissions(ctx, result.Claims.UserID)
 	if err != nil {
 		return nil, apiErrorCtx(ctx, ErrInternal, connect.CodeInternal, "failed to resolve permissions")
 	}
@@ -238,7 +238,7 @@ func (h *AuthHandler) GetCurrentUser(ctx context.Context, req *connect.Request[p
 		return nil, err
 	}
 
-	user, err := h.store.Queries().GetUserByID(ctx, userCtx.ID)
+	user, err := h.store.Repos().User.Get(ctx, userCtx.ID)
 	if err != nil {
 		return nil, handleGetError(ctx, err, ErrUserNotFound, "user not found")
 	}

internal/api/identity_link_handler.go

@@ -72,7 +72,7 @@ func (h *IdentityLinkHandler) UnlinkIdentity(ctx context.Context, req *connect.R
 	targetUserID := link.UserID
 
 	// Prevent unlinking last auth method
-	user, err := h.store.Queries().GetUserByID(ctx, targetUserID)
+	user, err := h.store.Repos().User.Get(ctx, targetUserID)
 	if err != nil {
 		return nil, apiErrorCtx(ctx, ErrInternal, connect.CodeInternal, "failed to get user")
 	}

internal/api/settings_handler.go

@@ -107,7 +107,7 @@ func (h *SettingsHandler) UpdateServerSettings(ctx context.Context, req *connect
 // enableProvisioningForAllUsers sets user_provisioning_enabled=true on every user
 // that doesn't already have it enabled.
 func (h *SettingsHandler) enableProvisioningForAllUsers(ctx context.Context) error {
-	users, err := h.store.Queries().ListAllNonDeletedUsers(ctx)
+	users, err := h.store.Repos().User.ListAllNonDeleted(ctx)
 	if err != nil {
 		return fmt.Errorf("list users: %w", err)
 	}
@@ -138,7 +138,7 @@ func (h *SettingsHandler) enableProvisioningForAllUsers(ctx context.Context) err
 // enableSshAccessForAllUsers sets ssh_access_enabled=true on every user
 // that doesn't already have it enabled.
 func (h *SettingsHandler) enableSshAccessForAllUsers(ctx context.Context) error {
-	users, err := h.store.Queries().ListAllNonDeletedUsers(ctx)
+	users, err := h.store.Repos().User.ListAllNonDeleted(ctx)
 	if err != nil {
 		return fmt.Errorf("list users: %w", err)
 	}

internal/api/sso_handler.go

@@ -53,7 +53,7 @@ func (h *SSOHandler) ListAuthMethods(ctx context.Context, req *connect.Request[p
 	// between "no such user" and "lookup errored" — that's a deliberate
 	// info-leak guard, see the comment below.
 	if req.Msg.Email != "" {
-		user, err := h.store.Queries().GetUserByEmail(ctx, req.Msg.Email)
+		user, err := h.store.Repos().User.GetByEmail(ctx, req.Msg.Email)
 		if err == nil {
 			resp.TotpEnabled = user.TotpEnabled
 
@@ -274,7 +274,7 @@ func (h *SSOHandler) SSOCallback(ctx context.Context, req *connect.Request[pm.SS
 	}
 
 	// Get and validate user before proceeding
-	user, err := h.store.Queries().GetUserByID(ctx, linkResult.UserID)
+	user, err := h.store.Repos().User.Get(ctx, linkResult.UserID)
 	if err != nil {
 		if store.IsNotFound(err) {
 			h.logger.Error("SSO user not found after link resolved — user may be soft-deleted",
@@ -361,7 +361,7 @@ func (h *SSOHandler) SSOCallback(ctx context.Context, req *connect.Request[pm.SS
 	}
 
 	// Generate tokens
-	permissions, err := h.store.Queries().GetUserPermissionsWithGroups(ctx, user.ID)
+	permissions, err := h.store.Repos().User.Permissions(ctx, user.ID)
 	if err != nil {
 		return nil, apiErrorCtx(ctx, ErrInternal, connect.CodeInternal, "failed to resolve permissions")
 	}

internal/api/system_actions.go

@@ -12,7 +12,6 @@ import (
 	"github.com/manchtools/power-manage/server/internal/actionparams"
 	"github.com/manchtools/power-manage/server/internal/ca"
 	"github.com/manchtools/power-manage/server/internal/store"
-	db "github.com/manchtools/power-manage/server/internal/store/generated"
 )
 
 // SystemActionManager creates and maintains system-managed actions
@@ -54,7 +53,7 @@ func NewSystemActionManager(st *store.Store, signer ca.ActionSigner, logger *slo
 // SyncAllUsersSystemActions ensures all users have correct system actions.
 // Called at startup and after global settings changes. Idempotent.
 func (m *SystemActionManager) SyncAllUsersSystemActions(ctx context.Context) error {
-	users, err := m.store.Queries().ListAllNonDeletedUsers(ctx)
+	users, err := m.store.Repos().User.ListAllNonDeleted(ctx)
 	if err != nil {
 		return fmt.Errorf("list users: %w", err)
 	}
@@ -145,7 +144,7 @@ func (m *SystemActionManager) StartReconciliation(ctx context.Context, interval,
 // Disabled users get a disabled flag in their USER action params.
 // Idempotent and safe to call after any user mutation.
 func (m *SystemActionManager) SyncUserSystemActions(ctx context.Context, userID string) error {
-	user, err := m.store.Queries().GetUserByID(ctx, userID)
+	user, err := m.store.Repos().User.Get(ctx, userID)
 	if err != nil {
 		return fmt.Errorf("get user: %w", err)
 	}
@@ -199,7 +198,7 @@ func (m *SystemActionManager) SyncUserSystemActions(ctx context.Context, userID
 	// If the permission query fails, we skip the TTY block entirely
 	// and leave the existing state untouched — a transient DB error
 	// must NOT trigger a cleanup that deletes a working TTY account.
-	permissions, err := m.store.Queries().GetUserPermissionsWithGroups(ctx, userID)
+	permissions, err := m.store.Repos().User.Permissions(ctx, userID)
 	if err != nil {
 		m.logger.Error("failed to resolve user permissions for tty action sync; leaving TTY state unchanged",
 			"user_id", userID, "error", err)
@@ -227,7 +226,7 @@ func (m *SystemActionManager) SyncUserSystemActions(ctx context.Context, userID
 
 // CleanupDeletedUserActions removes all system actions for a deleted user.
 // Must be called with the user projection loaded BEFORE the delete event.
-func (m *SystemActionManager) CleanupDeletedUserActions(ctx context.Context, user db.UsersProjection) error {
+func (m *SystemActionManager) CleanupDeletedUserActions(ctx context.Context, user store.User) error {
 	if user.SystemUserActionID != "" {
 		if err := m.actions.DeleteAction(ctx, user.SystemUserActionID); err != nil {
 			m.logger.Error("failed to delete system user action", "action_id", user.SystemUserActionID, "error", err)
@@ -255,7 +254,7 @@ func (m *SystemActionManager) CleanupDeletedUserActions(ctx context.Context, use
 	return nil
 }
 
-func (m *SystemActionManager) syncUserProvisionAction(ctx context.Context, user db.UsersProjection, sshKeys []string) error {
+func (m *SystemActionManager) syncUserProvisionAction(ctx context.Context, user store.User, sshKeys []string) error {
 	comment := user.DisplayName
 	if comment == "" {
 		comment = user.Email
@@ -268,7 +267,7 @@ func (m *SystemActionManager) syncUserProvisionAction(ctx context.Context, user
 	// recur here.
 	params := &pm.UserParams{
 		Username:   user.LinuxUsername,
-		Uid:        user.LinuxUid,
+		Uid:        user.LinuxUID,
 		CreateHome: true,
 		Comment:    comment,
 		Disabled:   user.Disabled,
@@ -316,7 +315,7 @@ func (m *SystemActionManager) syncUserProvisionAction(ctx context.Context, user
 	return nil
 }
 
-func (m *SystemActionManager) syncSshAccessAction(ctx context.Context, user db.UsersProjection) error {
+func (m *SystemActionManager) syncSshAccessAction(ctx context.Context, user store.User) error {
 	// Typed *pm.SshParams — same rationale as syncUserProvisionAction.
 	params := &pm.SshParams{
 		Users:         []string{user.LinuxUsername},
@@ -363,7 +362,7 @@ func (m *SystemActionManager) syncSshAccessAction(ctx context.Context, user db.U
 	return nil
 }
 
-func (m *SystemActionManager) cleanupUserAction(ctx context.Context, user db.UsersProjection) error {
+func (m *SystemActionManager) cleanupUserAction(ctx context.Context, user store.User) error {
 	if user.SystemUserActionID == "" {
 		return nil
 	}
@@ -377,7 +376,7 @@ func (m *SystemActionManager) cleanupUserAction(ctx context.Context, user db.Use
 	return nil
 }
 
-func (m *SystemActionManager) cleanupSshAction(ctx context.Context, user db.UsersProjection) error {
+func (m *SystemActionManager) cleanupSshAction(ctx context.Context, user store.User) error {
 	if user.SystemSshActionID == "" {
 		return nil
 	}
@@ -402,7 +401,7 @@ func (m *SystemActionManager) cleanupSshAction(ctx context.Context, user db.User
 // The action uses nologin as the shell (the agent temporarily
 // activates it during a session), no home directory, and the
 // deterministic UID from the SDK's TTYUID helper.
-func (m *SystemActionManager) syncTtyUserAction(ctx context.Context, user db.UsersProjection) error {
+func (m *SystemActionManager) syncTtyUserAction(ctx context.Context, user store.User) error {
 	// Typed *pm.UserParams so the Go compiler rejects field-name
 	// typos. The previous map[string]any form accepted "system": true
 	// as a sibling of real fields — protojson silently dropped it on
@@ -467,9 +466,9 @@ func (m *SystemActionManager) syncTtyUserAction(ctx context.Context, user db.Use
 	return nil
 }
 
-func systemTtyUserParams(user db.UsersProjection) *pm.UserParams {
+func systemTtyUserParams(user store.User) *pm.UserParams {
 	ttyUsername := "pm-tty-" + user.LinuxUsername
-	ttyUID := int32(int(user.LinuxUid) + 100000) // terminal.DefaultUIDOffset
+	ttyUID := int32(int(user.LinuxUID) + 100000) // terminal.DefaultUIDOffset
 
 	return &pm.UserParams{
 		Username:   ttyUsername,
@@ -482,7 +481,7 @@ func systemTtyUserParams(user db.UsersProjection) *pm.UserParams {
 	}
 }
 
-func (m *SystemActionManager) cleanupTtyAction(ctx context.Context, user db.UsersProjection) error {
+func (m *SystemActionManager) cleanupTtyAction(ctx context.Context, user store.User) error {
 	if user.SystemTtyActionID == "" {
 		return nil
 	}

internal/api/system_actions_manager_test.go

@@ -71,7 +71,7 @@ func TestSyncUserSystemActions_NoLinuxUsername_NoOps(t *testing.T) {
 
 	require.NoError(t, m.SyncUserSystemActions(context.Background(), userID))
 
-	user, err := st.Queries().GetUserByID(context.Background(), userID)
+	user, err := st.Repos().User.Get(context.Background(), userID)
 	require.NoError(t, err)
 	assert.Empty(t, user.SystemUserActionID, "no linux_username → manager must NOT have created a USER action")
 	assert.Empty(t, user.SystemSshActionID, "no linux_username → no SSH action either")
@@ -90,7 +90,7 @@ func TestSyncUserSystemActions_ProvisioningDisabled_NoActionsCreated(t *testing.
 
 	require.NoError(t, m.SyncUserSystemActions(context.Background(), userID))
 
-	user, err := st.Queries().GetUserByID(context.Background(), userID)
+	user, err := st.Repos().User.Get(context.Background(), userID)
 	require.NoError(t, err)
 	assert.Empty(t, user.SystemUserActionID,
 		"provisioning disabled + no prior action → cleanup branch is a no-op (nothing to delete)")
@@ -108,7 +108,7 @@ func TestSyncUserSystemActions_GlobalProvisioning_CreatesUserAction(t *testing.T
 
 	require.NoError(t, m.SyncUserSystemActions(context.Background(), userID))
 
-	user, err := st.Queries().GetUserByID(context.Background(), userID)
+	user, err := st.Repos().User.Get(context.Background(), userID)
 	require.NoError(t, err)
 	require.NotEmpty(t, user.SystemUserActionID,
 		"provisioning enabled + linux_username → manager must create + link a system USER action")
@@ -131,7 +131,7 @@ func TestSyncUserSystemActions_SecondRun_UpdatesExistingAction(t *testing.T) {
 	enableGlobalProvisioning(t, st)
 
 	require.NoError(t, m.SyncUserSystemActions(context.Background(), userID))
-	user1, err := st.Queries().GetUserByID(context.Background(), userID)
+	user1, err := st.Repos().User.Get(context.Background(), userID)
 	require.NoError(t, err)
 	originalActionID := user1.SystemUserActionID
 	require.NotEmpty(t, originalActionID)
@@ -140,7 +140,7 @@ func TestSyncUserSystemActions_SecondRun_UpdatesExistingAction(t *testing.T) {
 	// branch (not the create branch) so the action ID stays stable —
 	// otherwise downstream assignments would dangle.
 	require.NoError(t, m.SyncUserSystemActions(context.Background(), userID))
-	user2, err := st.Queries().GetUserByID(context.Background(), userID)
+	user2, err := st.Repos().User.Get(context.Background(), userID)
 	require.NoError(t, err)
 	assert.Equal(t, originalActionID, user2.SystemUserActionID,
 		"second sync MUST keep the same action ID — re-creating would orphan the assignment row")
@@ -157,7 +157,7 @@ func TestCleanupDeletedUserActions_RemovesAllSystemActions(t *testing.T) {
 	enableGlobalProvisioning(t, st)
 
 	require.NoError(t, m.SyncUserSystemActions(context.Background(), userID))
-	user, err := st.Queries().GetUserByID(context.Background(), userID)
+	user, err := st.Repos().User.Get(context.Background(), userID)
 	require.NoError(t, err)
 	require.NotEmpty(t, user.SystemUserActionID, "precondition: user has a system action")
 
@@ -167,7 +167,7 @@ func TestCleanupDeletedUserActions_RemovesAllSystemActions(t *testing.T) {
 
 	// User's link columns are now empty — confirms the cleanup
 	// emitted UserSystemActionLinked with action_id="".
-	after, err := st.Queries().GetUserByID(context.Background(), userID)
+	after, err := st.Repos().User.Get(context.Background(), userID)
 	require.NoError(t, err)
 	assert.Empty(t, after.SystemUserActionID, "cleanup MUST clear system_user_action_id")
 }
@@ -184,7 +184,7 @@ func TestSyncUserSystemActions_DisablingProvisioningCleansUpExistingAction(t *te
 
 	// First sync creates the action.
 	require.NoError(t, m.SyncUserSystemActions(context.Background(), userID))
-	user, err := st.Queries().GetUserByID(context.Background(), userID)
+	user, err := st.Repos().User.Get(context.Background(), userID)
 	require.NoError(t, err)
 	require.NotEmpty(t, user.SystemUserActionID)
 
@@ -199,7 +199,7 @@ func TestSyncUserSystemActions_DisablingProvisioningCleansUpExistingAction(t *te
 
 	// Second sync must take the cleanup branch.
 	require.NoError(t, m.SyncUserSystemActions(context.Background(), userID))
-	after, err := st.Queries().GetUserByID(context.Background(), userID)
+	after, err := st.Repos().User.Get(context.Background(), userID)
 	require.NoError(t, err)
 	assert.Empty(t, after.SystemUserActionID,
 		"provisioning flipped off → cleanup branch must clear the prior link")

internal/api/system_actions_params_canary_test.go

@@ -9,7 +9,7 @@ import (
 
 	pm "github.com/manchtools/power-manage/sdk/gen/go/pm/v1"
 	"github.com/manchtools/power-manage/server/internal/actionparams"
-	db "github.com/manchtools/power-manage/server/internal/store/generated"
+	"github.com/manchtools/power-manage/server/internal/store"
 )
 
 // Tests in this file lock down the "system-managed actions must
@@ -153,9 +153,9 @@ func TestMarshalActionParamsRejectsNil(t *testing.T) {
 }
 
 func TestSystemTtyUserActionParamsOutput(t *testing.T) {
-	params, err := serializeProtoParams(systemTtyUserParams(db.UsersProjection{
+	params, err := serializeProtoParams(systemTtyUserParams(store.User{
 		LinuxUsername: "alice",
-		LinuxUid:      1000,
+		LinuxUID:      1000,
 		Disabled:      false,
 	}))
 	if err != nil {

internal/api/terminal_handler.go

@@ -86,7 +86,7 @@ func (h *TerminalHandler) StartTerminal(ctx context.Context, req *connect.Reques
 		return nil, apiErrorCtx(ctx, ErrNotAuthenticated, connect.CodeUnauthenticated, "not authenticated")
 	}
 
-	user, err := h.store.Queries().GetUserByID(ctx, userCtx.ID)
+	user, err := h.store.Repos().User.Get(ctx, userCtx.ID)
 	if err != nil {
 		if store.IsNotFound(err) {
 			return nil, apiErrorCtx(ctx, ErrUserNotFound, connect.CodeNotFound, "user not found")