penpot/backend/src/app/rpc/management/nitrate.clj

;; This Source Code Form is subject to the terms of the Mozilla Public
;; License, v. 2.0. If a copy of the MPL was not distributed with this
;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
;;
;; Copyright (c) KALEIDOS INC Sucursal en España SL

(ns app.rpc.management.nitrate
  "Internal Nitrate HTTP RPC API. Provides authenticated access to
  organization management and token validation endpoints."
  (:require
   [app.auth :as aauth]
   [app.auth.oidc :as oidc]
   [app.common.data :as d]
   [app.common.exceptions :as ex]
   [app.common.schema :as sm]
   [app.common.time :as ct]
   [app.common.types.organization :as cto]
   [app.common.types.profile :refer [schema:profile, schema:basic-profile]]
   [app.common.types.team :refer [schema:team]]
   [app.common.uuid :as uuid]
   [app.config :as cf]
   [app.db :as db]
   [app.email :as eml]
   [app.http :as-alias http]
   [app.http.session :as session]
   [app.loggers.audit :as audit]
   [app.media.validation :as media.v]
   [app.nitrate :as nitrate]
   [app.rpc :as rpc]
   [app.rpc.commands.auth :as auth]
   [app.rpc.commands.files :as files]
   [app.rpc.commands.nitrate :as cnit]
   [app.rpc.commands.profile :as profile]
   [app.rpc.commands.teams :as teams]
   [app.rpc.commands.teams-invitations :as ti]
   [app.rpc.doc :as doc]
   [app.rpc.nitrate.emails-helper :as neh]
   [app.rpc.nitrate.organization-helper :as noh]
   [app.rpc.notifications :as notifications]
   [app.storage :as sto]
   [app.util.services :as sv]
   [app.worker :as wrk]
   [cuerdas.core :as str]))


(defn- profile-to-map [profile]
  {:id            (:id profile)
   :name          (:fullname profile)
   :email         (:email profile)
   :created-at    (:created-at profile)
   :photo-url     (files/resolve-public-uri (get profile :photo-id))})

;; ---- API: authenticate

(sv/defmethod ::authenticate
  "Authenticate the current user"
  {::doc/added "2.14"
   ::sm/params [:map]
   ::sm/result schema:profile
   ::nitrate/sso false}
  [cfg {:keys [::rpc/profile-id] :as params}]
  (let [profile            (profile/get-profile cfg profile-id)]
    (-> (profile-to-map profile)
        (assoc :theme (:theme profile))
        (assoc :lang (:lang profile)))))

;; ---- API: get-teams

(def ^:private sql:get-teams
  "SELECT t.*
     FROM team AS t
     JOIN team_profile_rel AS tpr ON t.id = tpr.team_id
    WHERE tpr.profile_id = ?
      AND tpr.is_owner IS TRUE
      AND t.is_default IS FALSE
      AND t.deleted_at IS NULL;")

;; ---- API: get-penpot-version

(def ^:private schema:get-penpot-version-result
  [:map
   [:version
    [:map
     [:full [:maybe ::sm/text]]
     [:branch [:maybe ::sm/text]]
     [:base [:maybe ::sm/text]]
     [:main [:maybe ::sm/text]]
     [:major [:maybe ::sm/text]]
     [:minor [:maybe ::sm/text]]
     [:patch [:maybe ::sm/text]]
     [:modifier [:maybe ::sm/text]]
     [:commit [:maybe ::sm/text]]
     [:commit-hash [:maybe ::sm/text]]]]])

(sv/defmethod ::get-penpot-version
  "Get the current Penpot version"
  {::doc/added "2.14"
   ::sm/params [:map]
   ::sm/result schema:get-penpot-version-result
   ::rpc/auth false}
  [_cfg _params]
  {:version cf/version})

(def ^:private schema:get-teams-result
  [:vector schema:team])

(sv/defmethod ::get-teams
  "List teams for which current user is owner"
  {::doc/added "2.14"
   ::sm/params [:map]
   ::sm/result schema:get-teams-result
   ::nitrate/sso false}
  [cfg {:keys [::rpc/profile-id]}]
  (let [current-user-id (-> (profile/get-profile cfg profile-id) :id)]
    (->> (db/exec! cfg [sql:get-teams current-user-id])
         (map #(select-keys % [:id :name])))))

;; ---- API: upload-organization-logo

(def ^:private schema:upload-organization-logo
  [:map
   [:content media.v/schema:upload]
   [:organization-id ::sm/uuid]
   [:previous-id {:optional true} ::sm/uuid]])

(def ^:private schema:upload-organization-logo-result
  [:map [:id ::sm/uuid]])

(sv/defmethod ::upload-organization-logo
  "Store an organization logo in penpot storage and return its ID.
  Accepts an optional previous-id to mark the old logo for garbage
  collection when replacing an existing one."
  {::doc/added "2.17"
   ::sm/params schema:upload-organization-logo
   ::sm/result schema:upload-organization-logo-result
   ::nitrate/sso false}
  [{:keys [::sto/storage]} {:keys [content organization-id previous-id]}]
  (when previous-id
    (sto/touch-object! storage previous-id))
  (let [hash (sto/calculate-hash (:path content))
        data (-> (sto/content (:path content))
                 (sto/wrap-with-hash hash))
        obj  (sto/put-object! storage {::sto/content      data
                                       ::sto/deduplicate? true
                                       :bucket            "organization"
                                       :content-type      (:mtype content)
                                       :organization-id   organization-id})]
    {:id (:id obj)}))

;; ---- API: notify-team-change

(sv/defmethod ::notify-team-change
  "Notify to Penpot a team change from nitrate"
  {::doc/added "2.14"
   ::sm/params cto/schema:team-with-organization
   ::rpc/auth false}
  [cfg team]
  (notifications/notify-team-change cfg (select-keys team [:id :is-your-penpot :organization]) nil)
  nil)

;; ---- API: notify-user-added-to-organization

(def ^:private schema:notify-user-added-to-organization
  [:map
   [:profile-id ::sm/uuid]
   [:organization-id ::sm/uuid]
   [:role ::sm/text]])

(sv/defmethod ::notify-user-added-to-organization
  "Notify to Penpot that an user has joined an organization from nitrate"
  {::doc/added "2.14"
   ::sm/params schema:notify-user-added-to-organization
   ::rpc/auth false}
  [cfg {:keys [profile-id organization-id]}]
  (db/tx-run! cfg teams/create-default-organization-team profile-id organization-id))


;; ---- API: get-managed-profiles

(def ^:private sql:get-managed-profiles
  "SELECT DISTINCT p.id, p.fullname as name, p.email
     FROM profile p
     JOIN team_profile_rel tpr_member
       ON tpr_member.profile_id = p.id
    WHERE p.id <> ?
      AND EXISTS (
        SELECT 1
          FROM team_profile_rel tpr_owner
          JOIN team t
            ON t.id = tpr_owner.team_id
         WHERE tpr_owner.profile_id = ?
           AND tpr_owner.team_id = tpr_member.team_id
           AND tpr_owner.is_owner IS TRUE
           AND t.is_default IS FALSE
           AND t.deleted_at IS NULL);")

(def schema:managed-profile-result
  [:vector schema:basic-profile])

(sv/defmethod ::get-managed-profiles
  "List profiles that belong to teams for which current user is owner"
  {::doc/added "2.14"
   ::sm/params [:map]
   ::sm/result schema:managed-profile-result
   ::nitrate/sso false}
  [cfg {:keys [::rpc/profile-id]}]
  (let [current-user-id (-> (profile/get-profile cfg profile-id) :id)]
    (db/exec! cfg [sql:get-managed-profiles current-user-id current-user-id])))

;; ---- API: get-teams-summary

(def ^:private sql:get-teams-summary
  "SELECT t.id, t.name, t.is_default
     FROM team AS t
    WHERE t.id = ANY(?)
      AND t.deleted_at IS NULL;")

(def ^:private sql:get-files-count
  "SELECT COUNT(f.*) AS count
     FROM file AS f
     JOIN project AS p ON f.project_id = p.id
     JOIN team AS t ON t.id = p.team_id
    WHERE p.team_id = ANY(?)
      AND t.deleted_at IS NULL
      AND p.deleted_at IS NULL
      AND f.deleted_at IS NULL;")

(def ^:private schema:get-teams-summary-params
  [:map
   [:ids [:or ::sm/uuid [:vector ::sm/uuid]]]])

(def ^:private schema:get-teams-summary-result
  [:map
   [:teams [:vector [:map
                     [:id ::sm/uuid]
                     [:name ::sm/text]
                     [:is-default ::sm/boolean]]]]
   [:num-files ::sm/int]])

(sv/defmethod ::get-teams-summary
  "Get summary information for a list of teams"
  {::doc/added "2.15"
   ::sm/params schema:get-teams-summary-params
   ::sm/result schema:get-teams-summary-result
   ::nitrate/sso false}
  [cfg {:keys [ids]}]
  (let [;; Handle one or multiple params
        ids (cond
              (uuid? ids)
              [ids]

              (and (vector? ids) (every? uuid? ids))
              ids

              :else
              [])]
    (db/run! cfg (fn [{:keys [::db/conn]}]
                   (let [ids-array     (db/create-array conn "uuid" ids)
                         teams         (db/exec! conn [sql:get-teams-summary ids-array])
                         files-count   (-> (db/exec-one! conn [sql:get-files-count ids-array]) :count)]
                     {:teams teams
                      :num-files files-count})))))


;; ---- API: delete-teams-keeping-your-penpot-projects

(def ^:private sql:prefix-teams-name-and-unset-default
  "UPDATE team
      SET name = ? || name,
          is_default = FALSE
    WHERE id = ANY(?)
RETURNING id, name;")

(def ^:private sql:get-teams-files-counts
  "SELECT p.team_id, COUNT(f.*) AS total
     FROM file AS f
     JOIN project AS p ON (p.id = f.project_id)
     JOIN team AS t ON (t.id = p.team_id)
    WHERE t.id = ANY(?)
      AND t.deleted_at IS NULL
      AND p.deleted_at IS NULL
      AND f.deleted_at IS NULL
 GROUP BY p.team_id;")

(def ^:private sql:soft-delete-teams
  "UPDATE team
      SET deleted_at = ?
    WHERE id = ANY(?)
RETURNING id, deleted_at;")


;; ---- API: notify-organization-deletion

(def ^:private schema:notify-organization-deletion
  [:map
   [:organization-id ::sm/uuid]])


(defn- soft-delete-teams!
  "Soft-delete the provided team ids and submit a delete task per team."
  [{:keys [::db/conn] :as cfg} team-ids]
  (when (seq team-ids)
    (let [delay      (cf/get-deletion-delay)
          deleted-at (ct/in-future delay)
          updated    (db/exec! conn [sql:soft-delete-teams
                                     deleted-at
                                     (db/create-array conn "uuid" team-ids)])]
      (doseq [{:keys [id deleted-at]} updated]
        (wrk/submit! {::db/conn conn
                      ::wrk/task :delete-object
                      ::wrk/params {:object :team
                                    :deleted-at deleted-at
                                    :id id}}))))
  nil)

(defn manage-deleted-organization-teams
  "For a deleted organization, preserve organization teams unchanged and only prefix or
  delete member Your Penpot teams depending on whether they still contain files."
  [cfg {:keys [organization-id organization-name teams]}]
  (let [all-team-ids (->> teams
                          (map :id)
                          (filter uuid?)
                          distinct
                          (into []))
        your-penpot-team-ids (->> teams
                                  (filter :is-your-penpot)
                                  (map :id)
                                  (filter uuid?)
                                  distinct
                                  (into []))]
    (when (seq all-team-ids)
      (let [organization-prefix (str "[" (d/sanitize-string organization-name) "] ")]
        (db/tx-run!
         cfg
         (fn [{:keys [::db/conn] :as cfg}]
           (let [teams-with-files (if (seq your-penpot-team-ids)
                                    (->> (db/exec! conn [sql:get-teams-files-counts
                                                         (db/create-array conn "uuid" your-penpot-team-ids)])
                                         (filter (fn [{:keys [total]}] (pos? total)))
                                         (map :team-id)
                                         (into #{}))
                                    #{})
                 teams-to-prefix  (->> your-penpot-team-ids (filter teams-with-files) (into []))
                 teams-to-delete  (->> your-penpot-team-ids (remove teams-with-files) (into []))]

             ;; Organization teams move to the fallback organization unchanged. Only imported
             ;; Your Penpot teams keep the organization prefix when they still have files.
             (when (seq teams-to-prefix)
               (db/exec! conn [sql:prefix-teams-name-and-unset-default
                               organization-prefix
                               (db/create-array conn "uuid" teams-to-prefix)]))

             ;; Empty imported Your Penpot teams disappear entirely.
             (soft-delete-teams! cfg teams-to-delete)

             (notifications/notify-organization-deletion cfg organization-id organization-name all-team-ids teams-to-delete)
             nil)))))))


(sv/defmethod ::notify-organization-deletion
  "For a deleted organization, preserve organization teams and only prefix or delete
   imported Your Penpot teams before notifying connected users."
  {::doc/added "2.15"
   ::sm/params schema:notify-organization-deletion
   ::rpc/auth false}
  [cfg {:keys [organization-id]}]
  (let [organization-summary (nitrate/call cfg :get-organization-summary {:organization-id organization-id})
        teams       (:teams organization-summary)]
    (manage-deleted-organization-teams cfg {:organization-name (:name organization-summary)
                                            :organization-id (:id organization-summary)
                                            :teams teams})
    nil))

;; ---- API: notify-user-organizations-deletion

(def ^:private schema:notify-user-organizations-deletion
  [:map
   [:profile-id ::sm/uuid]])

(sv/defmethod ::notify-user-organizations-deletion
  "For a given user, find all owned organizations and apply the deleted-organization
   transfer rules to their imported Your Penpot teams."
  {::doc/added "2.18"
   ::sm/params schema:notify-user-organizations-deletion
   ::nitrate/sso false}
  [cfg {:keys [profile-id]}]
  (let [owned-organizations (nitrate/call cfg :get-owned-organizations {:profile-id profile-id})]
    (doseq [organization owned-organizations]
      (let [organization-name (:name organization)
            teams             (:teams organization)]
        (manage-deleted-organization-teams cfg {:organization-name organization-name
                                                :organization-id (:id organization)
                                                :teams teams}))))
  nil)




;; ---- API: get-profile-by-email

(def ^:private sql:get-profile-by-email
  "SELECT DISTINCT id, fullname, email, photo_id
     FROM profile
    WHERE email = ?
      AND deleted_at IS NULL;")

(sv/defmethod ::get-profile-by-email
  "Get profile by email"
  {::doc/added "2.15"
   ::sm/params [:map [:email ::sm/email]]
   ::sm/result schema:profile
   ::nitrate/sso false}
  [cfg {:keys [email]}]
  (let [profile (db/exec-one! cfg [sql:get-profile-by-email email])]
    (when-not profile
      (ex/raise :type :not-found
                :code :profile-not-found
                :hint "profile does not exist"
                :email email))
    (profile-to-map profile)))


;; ---- API: get-profile-by-id

(def ^:private sql:get-profile-by-id
  "SELECT DISTINCT id, fullname, email, photo_id
     FROM profile
    WHERE id = ?
      AND deleted_at IS NULL;")

(sv/defmethod ::get-profile-by-id
  "Get profile by email"
  {::doc/added "2.15"
   ::sm/params [:map [:id ::sm/uuid]]
   ::sm/result schema:profile
   ::nitrate/sso false}
  [cfg {:keys [id]}]
  (let [profile (db/exec-one! cfg [sql:get-profile-by-id id])]
    (when-not profile
      (ex/raise :type :not-found
                :code :profile-not-found
                :hint "profile does not exist"
                :id id))
    (profile-to-map profile)))


;; ---- API: get-organization-member-team-counts

(def ^:private sql:get-organization-member-team-counts
  "SELECT tpr.profile_id, COUNT(DISTINCT t.id) AS team_count
     FROM team_profile_rel AS tpr
     JOIN team AS t ON t.id = tpr.team_id
    WHERE t.id = ANY(?)
      AND t.deleted_at IS NULL
      AND t.is_default IS FALSE
    GROUP BY tpr.profile_id;")

(def ^:private schema:get-organization-member-team-counts-params
  [:map [:team-ids [:or ::sm/uuid [:vector ::sm/uuid]]]])

(def ^:private schema:get-organization-member-team-counts-result
  [:vector [:map
            [:profile-id ::sm/uuid]
            [:team-count ::sm/int]]])

(sv/defmethod ::get-organization-member-team-counts
  "Get the number of non-default teams each profile belongs to within a set of teams."
  {::doc/added "2.15"
   ::sm/params schema:get-organization-member-team-counts-params
   ::sm/result schema:get-organization-member-team-counts-result
   ::rpc/auth false}
  [cfg {:keys [team-ids]}]
  (let [team-ids (cond
                   (uuid? team-ids)
                   [team-ids]

                   (and (vector? team-ids) (every? uuid? team-ids))
                   team-ids

                   :else
                   [])]
    (if (empty? team-ids)
      []
      (db/run! cfg (fn [{:keys [::db/conn]}]
                     (let [ids-array (db/create-array conn "uuid" team-ids)]
                       (db/exec! conn [sql:get-organization-member-team-counts ids-array])))))))


;; API: invite-to-organization

(sv/defmethod ::invite-to-organization
  "Invite to organization"
  {::doc/added "2.15"
   ::sm/params [:map
                [:email ::sm/email]
                [:organization cto/schema:organization-with-avatar]]
   ::nitrate/sso false}
  [cfg params]
  (db/tx-run! cfg ti/create-organization-invitation params)
  nil)


;; API: get-organization-invitations

(def ^:private schema:get-organization-invitations-params
  [:map
   [:organization-id ::sm/uuid]])

(def ^:private schema:get-organization-invitations-result
  [:vector
   [:map
    [:id ::sm/uuid]
    [:organization-id {:optional true} [:maybe ::sm/uuid]]
    [:email ::sm/email]
    [:sent-at ::sm/inst]
    [:name {:optional true} [:maybe ::sm/text]]
    [:profile-id {:optional true} [:maybe ::sm/uuid]]
    [:photo-url {:optional true} ::sm/uri]]])

(sv/defmethod ::get-organization-invitations
  "Get valid invitations for an organization, returning at most one invitation per email."
  {::doc/added "2.16"
   ::sm/params schema:get-organization-invitations-params
   ::sm/result schema:get-organization-invitations-result
   ::nitrate/sso false}
  [cfg {:keys [organization-id]}]
  (let [team-ids (noh/get-organization-team-ids cfg organization-id)]
    (db/run! cfg (fn [{:keys [::db/conn]}]
                   (->> (noh/get-organization-invitations conn organization-id team-ids)
                        (mapv (fn [{:keys [photo-id] :as invitation}]
                                (cond-> (dissoc invitation :photo-id)
                                  photo-id
                                  (assoc :photo-url (files/resolve-public-uri photo-id))))))))))


;; API: delete-organization-invitations

(def ^:private sql:delete-organization-invitations
  "DELETE FROM team_invitation AS ti
    WHERE ti.email_to = ?
      AND (ti.org_id = ? OR ti.team_id = ANY(?));")

(def ^:private schema:delete-organization-invitations-params
  [:map
   [:organization-id ::sm/uuid]
   [:email ::sm/email]])

(sv/defmethod ::delete-organization-invitations
  "Delete all invitations for one email in an organization scope (organization + organization teams)."
  {::doc/added "2.16"
   ::sm/params schema:delete-organization-invitations-params
   ::nitrate/sso false}
  [cfg {:keys [organization-id email]}]
  (let [clean-email (profile/clean-email email)
        team-ids    (noh/get-organization-team-ids cfg organization-id)]
    (db/run! cfg (fn [{:keys [::db/conn]}]
                   (let [ids-array (db/create-array conn "uuid" team-ids)]
                     (db/exec! conn [sql:delete-organization-invitations clean-email organization-id ids-array]))))
    nil))


;; API: delete-all-organization-invitations

(def ^:private sql:delete-all-organization-invitations
  "DELETE FROM team_invitation AS ti
    WHERE ti.org_id = ?
       OR ti.team_id = ANY(?);")

(def ^:private schema:delete-all-organization-invitations-params
  [:map
   [:organization-id ::sm/uuid]])

(sv/defmethod ::delete-all-organization-invitations
  "Delete every pending invitation associated with an organization (organization-level + team-level).
   Called from Nitrate when an organization is about to be deleted, so users that click
   their invitation token hit the existing invalid-token landing page."
  {::doc/added "2.18"
   ::sm/params schema:delete-all-organization-invitations-params
   ::rpc/auth false}
  [cfg {:keys [organization-id]}]
  (let [team-ids (noh/get-organization-team-ids cfg organization-id)]
    (db/run! cfg (fn [{:keys [::db/conn]}]
                   (let [ids-array (db/create-array conn "uuid" team-ids)]
                     (db/exec! conn [sql:delete-all-organization-invitations organization-id ids-array]))))
    nil))


;; API: remove-from-organization

(def ^:private sql:get-reassign-to
  "SELECT tpr.profile_id
     FROM team_profile_rel AS tpr
    WHERE tpr.team_id = ?
      AND tpr.profile_id <> ?
      AND tpr.is_owner IS NOT TRUE
    ORDER BY CASE
               WHEN tpr.is_admin IS TRUE THEN 1
               ELSE 2
             END,
             tpr.created_at,
             tpr.profile_id
    LIMIT 1;")

(defn add-reassign-to [cfg profile-id team-to-transfer]
  (let [reassign-to (-> (db/exec-one! cfg [sql:get-reassign-to (:id team-to-transfer) profile-id])
                        :profile-id)]
    (when-not reassign-to
      (ex/raise :type :validation
                :code :nobody-to-reassign-team))

    (assoc team-to-transfer :reassign-to reassign-to)))

(sv/defmethod ::remove-from-organization
  "Remove an user from an organization"
  {::doc/added "2.17"
   ::sm/params [:map
                [:profile-id ::sm/uuid]
                [:organization-id ::sm/uuid]
                [:organization-name ::sm/text]
                [:default-team-id ::sm/uuid]]
   ::db/transaction true
   ::nitrate/sso false}
  [cfg {actor-profile-id ::rpc/profile-id
        :keys [profile-id organization-id organization-name default-team-id]
        :as params}]
  (let [actor-profile-id (when-not (= actor-profile-id uuid/zero)
                           actor-profile-id)
        {:keys [valid-teams-to-delete-ids
                valid-teams-to-transfer
                valid-teams-to-exit]} (cnit/get-valid-teams cfg organization-id profile-id default-team-id)
        add-reassign-to (partial add-reassign-to cfg profile-id)

        valid-teams-to-leave (into valid-teams-to-exit
                                   (map add-reassign-to valid-teams-to-transfer))]

    (cnit/leave-organization cfg (assoc params
                                        :id organization-id
                                        :name organization-name
                                        :teams-to-delete valid-teams-to-delete-ids
                                        :teams-to-leave valid-teams-to-leave
                                        :skip-validation true
                                        :user-who-delete-member actor-profile-id
                                        :deleted-by-role (when actor-profile-id
                                                           "organization-owner")))
    (notifications/notify-user-organization-change cfg profile-id organization-id organization-name "dashboard.user-no-longer-belong-organization")
    nil))

;; API: get-remove-from-organization-summary

(def ^:private schema:get-remove-from-organization-summary-result
  [:map
   [:teams-to-delete ::sm/int]
   [:teams-to-transfer ::sm/int]
   [:teams-to-exit ::sm/int]
   [:teams-to-detach ::sm/int]])

(sv/defmethod ::get-remove-from-organization-summary
  "Get a summary of the teams that would be deleted, transferred, or exited
   if the user were removed from the organization"
  {::doc/added "2.17"
   ::sm/params [:map
                [:profile-id ::sm/uuid]
                [:organization-id ::sm/uuid]
                [:default-team-id ::sm/uuid]]
   ::sm/result schema:get-remove-from-organization-summary-result
   ::db/transaction true
   ::nitrate/sso false}
  [cfg {:keys [profile-id organization-id default-team-id]}]
  (let [{:keys [valid-teams-to-delete-ids
                valid-teams-to-transfer
                valid-teams-to-exit
                valid-default-team]} (cnit/get-valid-teams cfg organization-id profile-id default-team-id)]
    (when-not valid-default-team
      (ex/raise :type :validation
                :code :not-valid-teams))
    (cnit/get-leave-organization-summary cfg
                                         default-team-id
                                         valid-teams-to-delete-ids
                                         (count valid-teams-to-transfer)
                                         (count valid-teams-to-exit))))

;; API: send-renewal-email

(def ^:private schema:send-renewal-email-params
  [:map
   [:profile-id ::sm/uuid]
   [:user-email ::sm/email]
   [:user-name [:maybe ::sm/text]]
   [:renewal-date :string]
   [:estimated-amount :double]
   [:organizations [:vector cto/schema:organization-with-avatar]]])

(sv/defmethod ::send-renewal-email
  "Send an Enterprise subscription renewal notice email to a user."
  {::doc/added "2.17"
   ::sm/params schema:send-renewal-email-params
   ::rpc/auth false}
  [cfg {:keys [profile-id user-email user-name renewal-date estimated-amount organizations]}]
  (let [amount-str (format "$%.2f" estimated-amount)
        user-name  (if (str/empty? user-name)
                     (:fullname (profile/get-profile cfg profile-id))
                     user-name)]
    (db/tx-run! cfg (fn [{:keys [::db/conn]}]
                      (eml/send! {::eml/conn    conn
                                  ::eml/factory eml/renewal-notice
                                  :public-uri   (cf/get :public-uri)
                                  :to           user-email
                                  :user-name    user-name
                                  :renewal-date renewal-date
                                  :estimated-amount amount-str
                                  :organizations organizations}))))
  nil)

;; API: exists-organization-team-invitations-for-non-members /
;;      delete-organization-team-invitations-for-non-members

(def ^:private sql:get-profile-emails-by-ids
  "SELECT email
     FROM profile
    WHERE id = ANY(?)
      AND deleted_at IS NULL")

(def ^:private sql:exists-non-member-organization-team-invitations
  "SELECT EXISTS (
            SELECT 1
              FROM team_invitation
             WHERE team_id = ANY(?)
               AND email_to <> ALL(?)
         ) AS non_member")

(def ^:private sql:delete-non-member-organization-team-invitations
  "DELETE FROM team_invitation
    WHERE team_id = ANY(?)
      AND email_to <> ALL(?)
   RETURNING email_to")

(def ^:private schema:organization-team-invitations-for-non-members-params
  [:map
   [:team-ids [:vector ::sm/uuid]]
   [:member-ids [:vector ::sm/uuid]]])

(def ^:private schema:exists-organization-team-invitations-for-non-members-result
  [:map [:exists ::sm/boolean]])

(defn- organization-team-invitations-for-non-members-arrays
  "Member emails and PG arrays used by exists/delete organization team invitation endpoints."
  [conn {:keys [team-ids member-ids]}]
  (let [member-ids-array (db/create-array conn "uuid" member-ids)
        member-emails    (->> (db/exec! conn [sql:get-profile-emails-by-ids member-ids-array])
                              (map :email)
                              (into #{}))]
    {:emails-array (db/create-array conn "text" (vec member-emails))
     :teams-array  (db/create-array conn "uuid" team-ids)}))

(defn- non-member-organization-team-invitations-exist?
  [conn params]
  (let [{:keys [emails-array teams-array]}
        (organization-team-invitations-for-non-members-arrays conn params)]
    (-> (db/exec-one! conn [sql:exists-non-member-organization-team-invitations
                            teams-array
                            emails-array])
        :non-member)))

(sv/defmethod ::exists-organization-team-invitations-for-non-members
  "Return if there are any team invitations for emails that are not organization members."
  {::doc/added "2.18"
   ::sm/params schema:organization-team-invitations-for-non-members-params
   ::sm/result schema:exists-organization-team-invitations-for-non-members-result
   ::nitrate/sso false}
  [cfg params]
  (db/run! cfg (fn [{:keys [::db/conn]}]
                 {:exists (boolean (non-member-organization-team-invitations-exist? conn params))})))

(sv/defmethod ::delete-organization-team-invitations-for-non-members
  "Delete team invitations for emails that are not organization members."
  {::doc/added "2.18"
   ::sm/params schema:organization-team-invitations-for-non-members-params
   ::db/transaction true
   ::nitrate/sso false}
  [cfg params]
  (db/run! cfg (fn [{:keys [::db/conn]}]
                 (let [{:keys [emails-array teams-array]}
                       (organization-team-invitations-for-non-members-arrays conn params)]
                   (db/exec! conn [sql:delete-non-member-organization-team-invitations
                                   teams-array
                                   emails-array])
                   nil))))

;; ---- API: push-audit-events

(def ^:private schema:nitrate-audit-event
  [:map {:title "NitrateAuditEvent"}
   [:name [:and [:string {:max 250}]
           [:re #"[\d\w-]{1,50}"]]]
   [:type {:optional true} ::sm/text]
   [:profile-id ::sm/uuid]
   [:props {:optional true} [:map-of :keyword :any]]
   [:context {:optional true} [:map-of :keyword :any]]])

(def ^:private schema:push-audit-events-params
  [:map {:title "PushAuditEventsParams"}
   [:events [:vector schema:nitrate-audit-event]]])

(sv/defmethod ::push-audit-events
  "Push audit events from nitrate (strictly for nitrate backend
  events)"

  {::doc/added "2.19"
   ::audit/skip true
   ::sm/params schema:push-audit-events-params
   ::rpc/auth false}
  [cfg {:keys [::rpc/request-at events] :as params}]
  (let [request  (-> params meta ::http/request)
        context' (-> (audit/prepare-context-from-request request)
                     (assoc :request-id (::rpc/request-id params)))

        ip-addr  (::rpc/ip-addr params)]

    (run! (fn [{:keys [type name profile-id props context] :as event}]
            (let [context (-> (merge context (d/without-nils context'))
                              (d/without-nils))]
              (audit/submit cfg {:type (d/nilv type "action")
                                 :name name
                                 :profile-id profile-id
                                 :props (or props {})
                                 :context context
                                 :tracked-at request-at
                                 :ip-addr ip-addr})))
          events)

    nil))


;; ---- API: get-teams-detail

(def ^:private sql:get-teams-detail
  "SELECT
     t.id,
     t.name,
     t.photo_id,
     t.created_at,
       (SELECT MAX(activity.modified_at)
          FROM (
            SELECT p2.modified_at
              FROM project AS p2
             WHERE p2.team_id = t.id
               AND p2.deleted_at IS NULL
               AND p2.is_default IS FALSE
            UNION ALL
            SELECT f.modified_at
              FROM file AS f
              JOIN project AS p ON p.id = f.project_id
             WHERE p.team_id = t.id
               AND p.deleted_at IS NULL
               AND f.deleted_at IS NULL
            UNION ALL
            SELECT tpr2.created_at
              FROM team_profile_rel AS tpr2
             WHERE tpr2.team_id = t.id
               AND tpr2.is_owner IS NOT TRUE
            UNION ALL
            SELECT ti.updated_at
              FROM team_invitation AS ti
             WHERE ti.team_id = t.id
          ) AS activity) AS last_activity_at,
     owner_tpr.profile_id AS owner_profile_id,
     owner_p.fullname AS owner_name,
     owner_p.photo_id AS owner_photo_id,
     (SELECT COUNT(*)
        FROM project AS p3
       WHERE p3.team_id = t.id
         AND p3.deleted_at IS NULL
         AND p3.is_default IS FALSE) AS num_projects,
     (SELECT COUNT(*)
        FROM file AS f
        JOIN project AS p4 ON p4.id = f.project_id
       WHERE p4.team_id = t.id
         AND f.deleted_at IS NULL
         AND p4.deleted_at IS NULL) AS num_files,
     (SELECT COUNT(*)
        FROM team_profile_rel AS tpr
       WHERE tpr.team_id = t.id) AS num_members
   FROM team AS t
   LEFT JOIN team_profile_rel AS owner_tpr
     ON owner_tpr.team_id = t.id AND owner_tpr.is_owner IS TRUE
   LEFT JOIN profile AS owner_p
     ON owner_p.id = owner_tpr.profile_id
   WHERE t.id = ANY(?)
     AND t.deleted_at IS NULL
     AND t.is_default IS FALSE
   ORDER BY last_activity_at DESC NULLS LAST")

(def ^:private schema:get-teams-detail-params
  [:map
   [:organization-id ::sm/uuid]])

(def ^:private schema:get-teams-detail-result
  [:vector
   [:map
    [:id ::sm/uuid]
    [:name ::sm/text]
    [:photo-url {:optional true} ::sm/uri]
    [:created-at ::sm/inst]
    [:last-activity-at {:optional true} [:maybe ::sm/inst]]
    [:owner-profile-id {:optional true} [:maybe ::sm/uuid]]
    [:owner-name {:optional true} [:maybe ::sm/text]]
    [:owner-photo-url {:optional true} ::sm/uri]
    [:num-projects ::sm/int]
    [:num-files ::sm/int]
    [:num-members ::sm/int]]])

(sv/defmethod ::get-teams-detail
  "Get detailed information for all non-deleted teams in an organization,
   including owner info and project/file/member counts."
  {::doc/added "2.20"
   ::sm/params schema:get-teams-detail-params
   ::sm/result schema:get-teams-detail-result
   ::nitrate/sso false}
  [cfg {:keys [organization-id]}]
  (let [organization-summary (nitrate/call cfg :get-organization-summary {:organization-id organization-id})
        team-ids    (into [] (comp d/xf:map-id (filter uuid?)) (:teams organization-summary))]
    (if (empty? team-ids)
      []
      (db/run! cfg
               (fn [{:keys [::db/conn]}]
                 (let [ids-array (db/create-array conn "uuid" team-ids)]
                   (->> (db/exec! conn [sql:get-teams-detail ids-array])
                        (mapv (fn [{:keys [photo-id owner-photo-id] :as row}]
                                (cond-> (dissoc row :photo-id :owner-photo-id)
                                  photo-id       (assoc :photo-url       (files/resolve-public-uri photo-id))
                                  owner-photo-id (assoc :owner-photo-url (files/resolve-public-uri owner-photo-id))))))))))))

;; ---- API: check-organization-sso

(def ^:private schema:check-organization-sso-result
  [:map
   [:valid ::sm/boolean]])

(sv/defmethod ::check-organization-sso
  "Validate an organization SSO configuration by generating a login redirect URL.
  Nitrate calls this while configuring SSO to verify client credentials and OIDC
  discovery before saving the settings."
  {::doc/added "2.20"
   ::sm/params cto/schema:nitrate-sso
   ::sm/result schema:check-organization-sso-result
   ::rpc/auth false}
  [cfg params]
  {:valid (oidc/is-organization-sso-config-valid? cfg params)})

;; ---- API: notify-organization-sso-change
(sv/defmethod ::notify-organization-sso-change
  "Nitrate notifies that an organization sso values have changed"
  {::doc/added "2.19"
   ::sm/params [:map
                [:organization-id ::sm/uuid]
                [:updated-props ::sm/boolean]
                [:announce-activation ::sm/boolean]]
   ::rpc/auth false}
  [{:keys [::db/pool] :as cfg} {:keys [organization-id updated-props announce-activation]}]
  (when updated-props
    (rpc/invalidate-organization-sso-cache-by-organization! organization-id)
    (session/clear-organization-sso-sessions! pool organization-id))
  (notifications/notify-organization-change-sso cfg organization-id)
  (when announce-activation
    (neh/send-organization-setup-sso-emails! cfg organization-id))
  nil)

;; ---- API: bulk-create-profiles

(def ^:private schema:bulk-create-profiles-params
  [:map
   [:password [::sm/word-string {:max 500}]]
   [:emails [:vector ::sm/email]]])

(def ^:private schema:bulk-create-profiles-result
  [:map
   [:created [:vector ::sm/email]]
   [:skipped [:vector ::sm/email]]])

(defn- create-active-profile!
  "Create a single already-active profile (email pre-verified, onboarding
   skipped) plus its default team. Returns nil; existence checks happen in the
   caller so duplicates are skipped instead of aborting the whole batch."
  [cfg email password]
  (let [fullname (-> (str/split email "@") first)]
    (->> {:email email
          :fullname fullname
          :password password
          :is-active true
          :props {:onboarding-viewed true}}
         (auth/create-profile cfg)
         (auth/create-profile-rels cfg))
    nil))

(sv/defmethod ::bulk-create-profiles
  "Create multiple already-active profiles that share a single password. The
   created users skip email verification and onboarding. Emails that already
   belong to an existing profile are skipped. Intended for the Nitrate admin
   bulk-creation screen; access is gated by the shared key and, in Nitrate, an
   email allow-list. Requires the `admin-console-bulk-create-profiles` flag, disabled
   by default so it is only available on test environments."
  {::doc/added "2.19"
   ::sm/params schema:bulk-create-profiles-params
   ::sm/result schema:bulk-create-profiles-result
   ::rpc/auth false}
  [cfg {:keys [password emails]}]

  (when-not (contains? cf/flags :admin-console-bulk-create-profiles)
    (ex/raise :type :restriction
              :code :bulk-create-profiles-not-allowed
              :hint "Bulk profile creation is disabled by config."))

  (let [derived (aauth/derive-password password)]
    (db/tx-run!
     cfg
     (fn [{:keys [::db/conn] :as cfg}]
       (reduce
        (fn [acc email]
          (let [email (eml/clean email)]
            (if (profile/get-profile-by-email conn email)
              (update acc :skipped conj email)
              (do
                (create-active-profile! cfg email derived)
                (update acc :created conj email)))))
        {:created [] :skipped []}
        emails)))))