feat: complete Phase 0 Enterprise IAM

src/api/profile.rs

@@ -0,0 +1,140 @@
+use crate::db::repository::traits::AuditRepositoryExt;
+use axum::{Json, extract::State};
+use serde::Deserialize;
+use serde_json::{Value, json};
+
+use crate::{
+    error::{AppError, Result},
+    identity::users as identity_users,
+    middleware::{audit::AuditContext, auth::AuthUser},
+    security::passwords,
+    state::AppState,
+};
+
+/// GET /api/v1/profile
+pub async fn get_profile(State(state): State<AppState>, auth: AuthUser) -> Result<Json<Value>> {
+    let profile = state
+        .provider
+        .users()
+        .get_profile(&auth.user.id)
+        .await
+        .map_err(AppError::Database)?;
+    let user_roles = state.provider.roles().list_for_user(&auth.user.id).await?;
+    let sessions = state
+        .provider
+        .sessions()
+        .list_active_for_user(&auth.user.id)
+        .await
+        .map_err(AppError::Database)?;
+
+    Ok(Json(json!({
+        "user": {
+            "id": auth.user.id,
+            "username": auth.user.username,
+            "status": auth.user.status().to_string(),
+            "last_login_at": auth.user.last_login_at,
+            "created_at": auth.user.created_at,
+        },
+        "profile": {
+            "email": profile.as_ref().and_then(|p| p.email.clone()),
+            "full_name": profile.as_ref().and_then(|p| p.full_name.clone()),
+            "avatar_url": profile.as_ref().and_then(|p| p.avatar_url.clone()),
+        },
+        "roles": user_roles.into_iter().map(|r| r.name).collect::<Vec<_>>(),
+        "sessions": sessions.into_iter().map(|s| json!({
+            "id": s.id,
+            "ip_address": s.ip_address,
+            "user_agent": s.user_agent,
+            "created_at": s.created_at,
+            "last_seen_at": s.last_seen_at,
+            "expires_at": s.expires_at,
+        })).collect::<Vec<_>>(),
+        "placeholders": {
+            "avatar": "coming_soon",
+            "mfa": "coming_soon",
+            "recovery_codes": "coming_soon",
+        },
+    })))
+}
+
+#[derive(Debug, Deserialize)]
+pub struct UpdateProfileRequest {
+    pub email: Option<String>,
+    pub full_name: Option<String>,
+}
+
+/// PATCH /api/v1/profile
+pub async fn update_profile(
+    State(state): State<AppState>,
+    auth: AuthUser,
+    ctx: AuditContext,
+    Json(body): Json<UpdateProfileRequest>,
+) -> Result<Json<Value>> {
+    let profile = state
+        .provider
+        .users()
+        .upsert_profile(
+            &auth.user.id,
+            body.email.as_deref(),
+            body.full_name.as_deref(),
+        )
+        .await
+        .map_err(AppError::Database)?;
+
+    state
+        .provider
+        .audit()
+        .log(crate::audit::AuditEvent {
+            actor_id: Some(&auth.user.id),
+            target_id: Some(&auth.user.id),
+            action: "profile_updated",
+            resource_type: "user",
+            resource_id: Some(&auth.user.id),
+            severity: crate::db::models::AuditSeverity::Info,
+            ip: ctx.ip_address.as_deref(),
+            ua: ctx.user_agent.as_deref(),
+            metadata: None,
+        })
+        .await?;
+
+    Ok(Json(json!({
+        "profile": {
+            "email": profile.email,
+            "full_name": profile.full_name,
+            "avatar_url": profile.avatar_url,
+        }
+    })))
+}
+
+#[derive(Debug, Deserialize)]
+pub struct ChangePasswordRequest {
+    pub current_password: String,
+    pub new_password: String,
+}
+
+/// POST /api/v1/profile/password
+pub async fn change_password(
+    State(state): State<AppState>,
+    auth: AuthUser,
+    ctx: AuditContext,
+    Json(body): Json<ChangePasswordRequest>,
+) -> Result<Json<Value>> {
+    // Verify current password
+    let ok = passwords::verify_password(&body.current_password, &auth.user.password_hash)?;
+    if !ok {
+        return Err(AppError::Unauthorized);
+    }
+
+    identity_users::reset_password(
+        &state.provider,
+        &state.config.security,
+        &auth.user.id,
+        &body.new_password,
+        Some(&auth.user.id),
+        ctx.ip_address.as_deref(),
+        ctx.user_agent.as_deref(),
+    )
+    .await?;
+
+    Ok(Json(json!({ "success": true })))
+}