1 files changed, 64 insertions, 31 deletions

diff --git a/app/models/account.go b/app/models/account.go
index 0ae1821..61b144d 100644
--- a/app/models/account.go
+++ b/app/models/account.go
@@ -2,10 +2,11 @@ package models
 
 import (
         "context"
-        "fmt"
         "time"
 
         "code.crute.us/mcrute/golib/db/mongodb"
+        "go.mongodb.org/mongo-driver/bson"
+        "go.mongodb.org/mongo-driver/bson/primitive"
 )
 
 const accountCol = "accounts"
@@ -20,43 +21,48 @@ type AccountStore interface {
 }
 
 type Account struct {
-        ShortName              string `bson:"_id"`
-        AccountType            string
-        AccountNumber          int
-        Name                   string
-        ConsoleSessionDuration time.Duration
-        VaultMaterial          string
-        DefaultRegion          string
-        Users                  []string
+        ShortName              string        `bson:"_id" json:"short_name"`
+        AccountType            string        `json:"account_type"`
+        AccountNumber          int           `json:"account_number"`
+        Name                   string        `json:"name"`
+        ConsoleSessionDuration time.Duration `json:"console_session_duration, omitempty"`
+        VaultMaterial          string        `json:"vault_material,omitempty"`
+        DefaultRegion          string        `json:"default_region"`
+        Users                  []string      `json:"users,omitempty"`
+        Deleted                *time.Time    `json:"deleted,omitempty" bson:"deleted,omitempty"`
 }
 
 func (a *Account) ConsoleSessionDurationSecs() int64 {
         return int64(a.ConsoleSessionDuration.Seconds())
 }
 
-func (a *Account) CanAccess(u *User) bool {
-        if u.IsAdmin {
-                return true
-        }
-        // Linear search should be fine for now, these lists are pretty small
-        for _, n := range a.Users {
-                if n == u.Username {
-                        return true
-                }
-        }
-        return false
+func (a *Account) CanBeModifiedBy(u *User) bool {
+        return u.IsAdmin
 }
 
 type MongoDbAccountStore struct {
         Db *mongodb.Mongo
+
+        // ReturnDeleted will allow all methods to return deleted items. By default
+        // items where the Deleted field is set will not be returned. This should
+        // be the common cast for most code using this store but in some Admin
+        // use-cases it would be useful to show deleted accounts.
+        ReturnDeleted bool
 }
 
 // List returns all accounts in the system.
 func (s *MongoDbAccountStore) List(ctx context.Context) ([]*Account, error) {
         var out []*Account
-        if err := s.Db.FindAll(ctx, accountCol, &out); err != nil {
+
+        filter := bson.M{}
+        if !s.ReturnDeleted {
+                filter["deleted"] = primitive.Null{}
+        }
+
+        if err := s.Db.FindAllByFilter(ctx, accountCol, filter, &out); err != nil {
                 return nil, err
         }
+
         return out, nil
 }
 
@@ -68,34 +74,56 @@ func (s *MongoDbAccountStore) List(ctx context.Context) ([]*Account, error) {
 // just use List directly.
 func (s *MongoDbAccountStore) ListForUser(ctx context.Context, u *User) ([]*Account, error) {
         var out []*Account
-        filter := mongodb.AnyInTopLevelArray("Users", u.Username)
+
+        filter := mongodb.AnyInTopLevelArray("users", u.Username)
+        if !s.ReturnDeleted {
+                filter["deleted"] = primitive.Null{}
+        }
+
         if err := s.Db.FindAllByFilter(ctx, accountCol, filter, &out); err != nil {
                 return nil, err
         }
+
         return out, nil
 }
 
 func (s *MongoDbAccountStore) Get(ctx context.Context, id string) (*Account, error) {
         var a Account
-        if err := s.Db.FindOneById(ctx, accountCol, id, &a); err != nil {
+
+        filter := bson.M{"_id": id}
+        if !s.ReturnDeleted {
+                filter["deleted"] = primitive.Null{}
+        }
+
+        if err := s.Db.FindOneByFilter(ctx, accountCol, filter, &a); err != nil {
                 return nil, err
         }
+
         return &a, nil
 }
 
 // GetForUser returns an account if the user has access to this account,
 // otherwise it returns an error. This is the authorized version of Get.
 func (s *MongoDbAccountStore) GetForUser(ctx context.Context, id string, u *User) (*Account, error) {
-        a, err := s.Get(ctx, id)
-        if err != nil {
-                return nil, err
+        var a Account
+        var filter bson.M
+
+        if u.IsAdmin {
+                filter = bson.M{"_id": id}
+        } else {
+                filter = mongodb.AnyInTopLevelArray("users", u.Username)
+                filter["_id"] = id
         }
 
-        if !a.CanAccess(u) {
-                return nil, fmt.Errorf("User does not have access to account")
+        if !s.ReturnDeleted {
+                filter["deleted"] = primitive.Null{}
         }
 
-        return a, nil
+        if err := s.Db.FindOneByFilter(ctx, accountCol, filter, &a); err != nil {
+                return nil, err
+        }
+
+        return &a, nil
 }
 
 func (s *MongoDbAccountStore) Put(ctx context.Context, a *Account) error {
@@ -106,10 +134,15 @@ func (s *MongoDbAccountStore) Put(ctx context.Context, a *Account) error {
 }
 
 func (s *MongoDbAccountStore) Delete(ctx context.Context, a *Account) error {
-        if err := s.Db.DeleteOneById(ctx, accountCol, a.ShortName); err != nil {
+        a, err := s.Get(ctx, a.ShortName)
+        if err != nil {
                 return err
         }
-        return nil
+
+        now := time.Now()
+        a.Deleted = &now
+
+        return s.Put(ctx, a)
 }
 
 var _ AccountStore = (*MongoDbAccountStore)(nil)