allowthem_saas/

tenants.rs

use std::path::{Path, PathBuf};
use std::sync::Arc;

use chrono::{DateTime, Utc};
use sqlx::SqlitePool;
use uuid::Uuid;

use allowthem_core::applications::CreateApplicationParams;
use allowthem_core::types::ClientType;
use allowthem_core::{AllowThem, ClientSecret, EmailSender, EventSink};

use crate::control_db::ControlDb;
use crate::error::{SaasError, map_slug_conflict};
use crate::mau::MauSink;
use crate::router::is_reserved_slug;

/// Validates slug format per spec §4 step 1: ^[a-z][a-z0-9-]{2,39}$
pub fn validate_slug(slug: &str) -> Result<(), SaasError> {
    if is_reserved_slug(slug) {
        return Err(SaasError::SlugReserved);
    }
    let bytes = slug.as_bytes();
    if bytes.len() < 3 || bytes.len() > 40 {
        return Err(SaasError::SlugInvalid("must be 3–40 characters"));
    }
    if !bytes[0].is_ascii_lowercase() {
        return Err(SaasError::SlugInvalid("must start with a lowercase letter"));
    }
    let rest_valid = bytes[1..]
        .iter()
        .all(|b| b.is_ascii_lowercase() || b.is_ascii_digit() || *b == b'-');
    if !rest_valid {
        return Err(SaasError::SlugInvalid(
            "only lowercase letters, digits, and hyphens allowed",
        ));
    }
    Ok(())
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, sqlx::Type, serde::Serialize, serde::Deserialize)]
#[sqlx(type_name = "TEXT", rename_all = "lowercase")]
#[serde(rename_all = "lowercase")]
pub enum TenantStatus {
    Active,
    Suspended,
    Deleted,
}

/// A row from the `tenants` control-plane table.
#[derive(Debug, Clone, sqlx::FromRow, serde::Serialize, serde::Deserialize)]
pub struct Tenant {
    pub id: Vec<u8>, // UUIDv7 bytes (BLOB)
    pub name: String,
    pub slug: String,
    pub owner_email: String,
    pub plan_id: Vec<u8>, // opaque randomblob(16) from seed migration
    pub status: TenantStatus,
    pub db_path: String,
    pub last_seen_at: Option<DateTime<Utc>>,
    pub created_at: DateTime<Utc>,
    pub updated_at: DateTime<Utc>,
}

impl Tenant {
    pub fn id_as_uuid(&self) -> Option<Uuid> {
        Uuid::from_slice(&self.id).ok()
    }
}

/// UUIDv7-backed identifier for a tenant.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct TenantId(Uuid);

impl Default for TenantId {
    fn default() -> Self {
        Self::new()
    }
}

impl TenantId {
    pub fn new() -> Self {
        Self(Uuid::now_v7())
    }

    pub fn as_uuid(&self) -> &Uuid {
        &self.0
    }

    /// Returns raw bytes suitable for binding to a BLOB column.
    pub fn as_bytes(&self) -> &[u8] {
        self.0.as_bytes()
    }
}

impl From<Uuid> for TenantId {
    fn from(u: Uuid) -> Self {
        Self(u)
    }
}

/// UUIDv7-backed identifier for a `tenant_members` row.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct MemberId(Uuid);

impl MemberId {
    pub fn new() -> Self {
        Self(Uuid::now_v7())
    }

    pub fn as_uuid(&self) -> &Uuid {
        &self.0
    }

    /// Raw 16-byte payload suitable for binding to a SQLite BLOB column.
    pub fn as_bytes(&self) -> &[u8] {
        self.0.as_bytes()
    }
}

impl Default for MemberId {
    fn default() -> Self {
        Self::new()
    }
}

impl From<Uuid> for MemberId {
    fn from(u: Uuid) -> Self {
        Self(u)
    }
}

/// UUIDv7-backed identifier for a `tenant_plans` row. Plans are seeded
/// (no `new()` — the IDs come from the seed migration), so unlike
/// [`MemberId`] there's no constructor.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct PlanId(Uuid);

impl PlanId {
    pub fn as_uuid(&self) -> &Uuid {
        &self.0
    }

    pub fn as_bytes(&self) -> &[u8] {
        self.0.as_bytes()
    }
}

impl From<Uuid> for PlanId {
    fn from(u: Uuid) -> Self {
        Self(u)
    }
}

/// One row of `tenant_members`. Mirrors the BLOB-as-`Vec<u8>` convention
/// used by [`Tenant`]; call [`Self::id_as_member_id`] to unpack into a
/// typed handle.
#[derive(Debug, Clone, sqlx::FromRow, serde::Serialize, serde::Deserialize)]
pub struct TenantMember {
    pub id: Vec<u8>,
    pub tenant_id: Vec<u8>,
    pub email: String,
    pub role: crate::control_db::TenantRole,
    pub invited_at: DateTime<Utc>,
    pub accepted_at: Option<DateTime<Utc>>,
    /// Unix seconds; `NULL` once the invite has been accepted (and the
    /// hash is also cleared then).
    pub invite_token_expires_at: Option<i64>,
}

impl TenantMember {
    pub fn id_as_member_id(&self) -> Option<MemberId> {
        Uuid::from_slice(&self.id).ok().map(MemberId::from)
    }

    pub fn tenant_id_as_tenant_id(&self) -> Option<TenantId> {
        Uuid::from_slice(&self.tenant_id).ok().map(TenantId::from)
    }
}

/// One row of `tenant_plans`. Read-only at v1 (plans are seeded by a
/// migration). `features` is the raw JSON string from the column;
/// callers parse on demand.
#[derive(Debug, Clone, sqlx::FromRow, serde::Serialize, serde::Deserialize)]
pub struct TenantPlan {
    pub id: Vec<u8>,
    pub name: String,
    pub mau_limit: i64,
    pub price_cents: i64,
    pub features: String,
}

impl TenantPlan {
    pub fn id_as_plan_id(&self) -> Option<PlanId> {
        Uuid::from_slice(&self.id).ok().map(PlanId::from)
    }
}

/// SaaS-wide keys and base domain needed when building a tenant AllowThem handle.
pub struct TenantBuilderConfig {
    pub mfa_key: [u8; 32],
    pub signing_key: [u8; 32],
    pub csrf_key: [u8; 32],
    pub base_domain: String,
    /// Drives the cookie name + Secure attribute for tenant sessions.
    /// `__Host-` requires Secure → requires HTTPS, so dev (HTTP localhost)
    /// uses the plain name and `Secure=false`.
    pub is_production: bool,
    /// Optional email sender shared across all tenant handles built from this
    /// config. When `None` the handle falls back to `NoopEmailSender` with a
    /// startup warning. Set to `Some` in production and in any integration test
    /// that exercises email flows.
    pub email_sender: Option<Arc<dyn EmailSender>>,
    /// Optional event sink. When `None` the handle uses `NoopEventSink` (silent).
    /// Set to `Some(Arc::new(LoggingEventSink))` in dev, or a real sink in production.
    ///
    /// Prefer `event_sink_factory` for any sink that needs the tenant id (e.g.
    /// the SaaS webhook sink). When both are set, the handle-builder uses the
    /// factory and ignores `event_sink`.
    pub event_sink: Option<Arc<dyn EventSink>>,
    /// Optional per-tenant event-sink factory. When `Some`, the handle-builder
    /// calls `factory.for_tenant(tenant_id)` once per tenant `AllowThem`
    /// build and binds the resulting sink to that tenant. Required for
    /// webhook delivery (epic 7xw.2) where the sink scopes its
    /// `tenant_webhooks` lookup by tenant id.
    pub event_sink_factory: Option<Arc<dyn crate::webhook_sink::EventSinkFactory>>,
    /// Optional MAU sink. When `Some`, every tenant `AllowThem` handle is built
    /// with an `on_user_active` callback that forwards events to this sink for
    /// control-plane MAU counting. `None` disables MAU tracking (e.g. embedded
    /// mode tests, or unit tests that don't exercise login flows).
    pub mau_sink: Option<Arc<MauSink>>,
    /// Optional per-tenant email-sender factory. When `Some`, the handle-builder
    /// calls `factory.for_tenant(tenant_id, &pool).await` once per tenant
    /// `AllowThem` build and binds the resolved sender to that tenant. The
    /// resolved sender takes precedence over `email_sender`. Use in SaaS-mode
    /// binaries; embedded integrators leave this `None` and rely on the
    /// simpler shared `email_sender` path.
    pub email_sender_factory: Option<Arc<dyn crate::managed_email::EmailSenderFactory>>,
}

/// Cookie name for tenant sessions.
///
/// Production uses the `__Host-` prefix, which forbids the `Domain` attribute
/// and requires `Secure` — both already true under SaaS deployment via Caddy
/// (per parent spec §6.2). Dev uses the plain name to keep the local HTTP
/// workflow friction-free.
pub fn tenant_cookie_name(is_production: bool) -> &'static str {
    if is_production {
        "__Host-allowthem_session"
    } else {
        "allowthem_session"
    }
}

/// Result of a successful `provision_tenant` call.
pub struct ProvisionResult {
    pub tenant: Tenant,
    /// The AllowThem handle for the new tenant — hold this alive to keep the pool open.
    pub ath: AllowThem,
    pub client_id: String,
    pub client_secret: ClientSecret,
}

// ---------------------------------------------------------------------------
// RAII guard — deletes tenant DB files on drop unless disarmed.
// ---------------------------------------------------------------------------

struct TenantDbFileGuard {
    path: PathBuf,
    disarmed: bool,
}

impl TenantDbFileGuard {
    fn new(path: PathBuf) -> Self {
        Self {
            path,
            disarmed: false,
        }
    }

    fn disarm(&mut self) {
        self.disarmed = true;
    }
}

impl Drop for TenantDbFileGuard {
    fn drop(&mut self) {
        if self.disarmed {
            return;
        }
        for suffix in ["", "-wal", "-shm"] {
            let p = PathBuf::from(format!("{}{suffix}", self.path.display()));
            let _ = std::fs::remove_file(p);
        }
    }
}

// ---------------------------------------------------------------------------
// Read queries
// ---------------------------------------------------------------------------

impl ControlDb {
    pub async fn tenant_by_slug(&self, slug: &str) -> Result<Option<Tenant>, SaasError> {
        let row = sqlx::query_as::<_, Tenant>(
            "SELECT id, name, slug, owner_email, plan_id, status, db_path, \
             last_seen_at, created_at, updated_at \
             FROM tenants WHERE slug = ?1",
        )
        .bind(slug)
        .fetch_optional(self.pool())
        .await?;
        Ok(row)
    }

    pub async fn tenant_by_id(&self, id: &TenantId) -> Result<Option<Tenant>, SaasError> {
        self.tenant_by_id_raw(id.as_bytes()).await
    }

    pub(crate) async fn tenant_by_id_raw(&self, id: &[u8]) -> Result<Option<Tenant>, SaasError> {
        let row = sqlx::query_as::<_, Tenant>(
            "SELECT id, name, slug, owner_email, plan_id, status, db_path, \
             last_seen_at, created_at, updated_at \
             FROM tenants WHERE id = ?1",
        )
        .bind(id)
        .fetch_optional(self.pool())
        .await?;
        Ok(row)
    }

    pub async fn tenant_by_owner_email(&self, email: &str) -> Result<Vec<Tenant>, SaasError> {
        let rows = sqlx::query_as::<_, Tenant>(
            "SELECT id, name, slug, owner_email, plan_id, status, db_path, \
             last_seen_at, created_at, updated_at \
             FROM tenants WHERE owner_email = ?1",
        )
        .bind(email)
        .fetch_all(self.pool())
        .await?;
        Ok(rows)
    }

    pub async fn list_tenants(&self) -> Result<Vec<Tenant>, SaasError> {
        let rows = sqlx::query_as::<_, Tenant>(
            "SELECT id, name, slug, owner_email, plan_id, status, db_path, \
             last_seen_at, created_at, updated_at \
             FROM tenants WHERE status != 'deleted' ORDER BY created_at ASC",
        )
        .fetch_all(self.pool())
        .await?;
        Ok(rows)
    }
}

// ---------------------------------------------------------------------------
// Simple mutations
// ---------------------------------------------------------------------------

impl ControlDb {
    pub async fn update_tenant_name(&self, id: &TenantId, name: String) -> Result<(), SaasError> {
        let rows = sqlx::query(
            "UPDATE tenants \
             SET name = ?1, updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') \
             WHERE id = ?2 AND status != 'deleted'",
        )
        .bind(&name)
        .bind(id.as_bytes())
        .execute(self.pool())
        .await?;
        if rows.rows_affected() == 0 {
            return Err(SaasError::TenantNotFound);
        }
        Ok(())
    }

    pub async fn suspend_tenant(&self, id: &TenantId) -> Result<(), SaasError> {
        let rows = sqlx::query(
            "UPDATE tenants \
             SET status = 'suspended', updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') \
             WHERE id = ?1 AND status = 'active'",
        )
        .bind(id.as_bytes())
        .execute(self.pool())
        .await?;
        if rows.rows_affected() == 0 {
            return Err(SaasError::TenantNotFound);
        }
        Ok(())
    }

    pub async fn delete_tenant(&self, id: &TenantId) -> Result<(), SaasError> {
        let rows = sqlx::query(
            "UPDATE tenants \
             SET status = 'deleted', updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') \
             WHERE id = ?1 AND status != 'deleted'",
        )
        .bind(id.as_bytes())
        .execute(self.pool())
        .await?;
        if rows.rows_affected() == 0 {
            return Err(SaasError::TenantNotFound);
        }
        Ok(())
    }
}

// ---------------------------------------------------------------------------
// Provisioning + update_tenant_slug
// ---------------------------------------------------------------------------

impl ControlDb {
    pub async fn provision_tenant(
        &self,
        name: String,
        slug: String,
        owner_email: String,
        tenant_data_dir: &Path,
        config: &TenantBuilderConfig,
    ) -> Result<ProvisionResult, SaasError> {
        use sqlx::sqlite::{SqliteConnectOptions, SqliteJournalMode};

        // Step 1: Validate slug.
        validate_slug(&slug)?;

        // Step 2: Begin control plane transaction.
        let mut tx = self.pool().begin().await?;

        // Step 3: Insert tenant row (status=active, plan=dev).
        let tenant_id = TenantId::new();
        let db_file = format!("{}.db", tenant_id.as_uuid());
        let inserted = sqlx::query(
            "INSERT INTO tenants (id, name, slug, owner_email, plan_id, status, db_path) \
             SELECT ?1, ?2, ?3, ?4, id, 'active', ?5 FROM tenant_plans WHERE name = 'dev'",
        )
        .bind(tenant_id.as_bytes())
        .bind(&name)
        .bind(&slug)
        .bind(&owner_email)
        .bind(&db_file)
        .execute(&mut *tx)
        .await
        .map_err(map_slug_conflict)?;

        // Guard: if 'dev' plan row is missing, the SELECT returns 0 rows →
        // INSERT is a no-op. Return an error before creating any files.
        if inserted.rows_affected() == 0 {
            return Err(SaasError::ProvisionFailed(
                "'dev' plan not found in tenant_plans".into(),
            ));
        }

        // Step 3b: Insert the owner row in the same transaction so a tenant
        // is never persisted without an owner. This is the "join key" the
        // dashboard uses to authorize a logged-in user against tenants they
        // own. UUIDv7 for monotonic id without an extra index.
        let member_id = Uuid::now_v7();
        sqlx::query(
            "INSERT INTO tenant_members (id, tenant_id, email, role, accepted_at) \
             VALUES (?1, ?2, ?3, 'owner', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))",
        )
        .bind(member_id.as_bytes().as_slice())
        .bind(tenant_id.as_bytes())
        .bind(&owner_email)
        .execute(&mut *tx)
        .await?;

        // Step 4: Create SQLite file. Guard auto-deletes on drop unless disarmed.
        // Declaration order is load-bearing (§0.4): file_guard must be declared before ath
        // so Rust's reverse drop order closes the pool before deleting the file on unwind.
        let full_path = tenant_data_dir.join(&db_file);
        let mut file_guard = TenantDbFileGuard::new(full_path.clone());

        let opts = SqliteConnectOptions::new()
            .filename(&full_path)
            .create_if_missing(true)
            .pragma("foreign_keys", "ON")
            .journal_mode(SqliteJournalMode::Wal)
            .busy_timeout(std::time::Duration::from_millis(5000));
        let pool = SqlitePool::connect_with(opts)
            .await
            .map_err(|e| SaasError::ProvisionFailed(e.to_string()))?;

        // Steps 5+6: Build handle — AllowThemBuilder::build() runs core migrations via Db::new.
        // No `cookie_domain` — host-only cookies satisfy the `__Host-` prefix
        // (see crates/core/sessions.rs:313). Tenant sessions are bound to the
        // exact `<slug>.<base_domain>` host the issuing request hit.
        let ath = allowthem_core::AllowThemBuilder::with_pool(pool)
            .mfa_key(config.mfa_key)
            .signing_key(config.signing_key)
            .csrf_key(config.csrf_key)
            .base_url(format!("https://{}.{}", slug, config.base_domain))
            .cookie_name(tenant_cookie_name(config.is_production))
            .cookie_secure(config.is_production)
            .build()
            .await
            .map_err(|e| SaasError::ProvisionFailed(e.to_string()))?;

        // Step 7: Create default OIDC application (ClientType::Confidential — §0.5).
        // validate_redirect_uris rejects empty slices; use a localhost placeholder.
        let (app, maybe_secret) = ath
            .db()
            .create_application(CreateApplicationParams {
                name: "Default OIDC Application".to_string(),
                client_type: ClientType::Confidential,
                redirect_uris: vec!["http://localhost/callback".to_string()],
                is_trusted: false,
                created_by: None,
                logo_url: None,
                primary_color: None,
                accent_hex: None,
                accent_ink: None,
                forced_mode: None,
                font_css_url: None,
                font_family: None,
                splash_text: None,
                splash_image_url: None,
                splash_primitive: None,
                splash_url: None,
                shader_cell_scale: None,
            })
            .await?;
        // ClientType::Confidential always yields Some(ClientSecret).
        let client_secret = maybe_secret.expect("confidential app always has a secret");

        // Step 8: Commit. Disarm file guard after commit — no cleanup on success.
        tx.commit().await?;
        file_guard.disarm();

        // Step 9: Fetch tenant row (updated_at etc. populated by DB defaults).
        let tenant = self
            .tenant_by_id_raw(tenant_id.as_bytes())
            .await?
            .ok_or(SaasError::TenantNotFound)?;

        Ok(ProvisionResult {
            tenant,
            ath,
            client_id: app.client_id.to_string(),
            client_secret,
        })
    }

    pub async fn update_tenant_slug(
        &self,
        id: &TenantId,
        new_slug: String,
        tenant_pool: &SqlitePool,
    ) -> Result<(), SaasError> {
        validate_slug(&new_slug)?;

        let has_sessions: bool =
            sqlx::query_scalar("SELECT EXISTS(SELECT 1 FROM allowthem_sessions LIMIT 1)")
                .fetch_one(tenant_pool)
                .await?;

        if has_sessions {
            return Err(SaasError::SlugChangeAfterFirstLogin);
        }

        let rows = sqlx::query(
            "UPDATE tenants \
             SET slug = ?1, updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') \
             WHERE id = ?2 AND status != 'deleted'",
        )
        .bind(&new_slug)
        .bind(id.as_bytes())
        .execute(self.pool())
        .await
        .map_err(map_slug_conflict)?;

        if rows.rows_affected() == 0 {
            return Err(SaasError::TenantNotFound);
        }
        Ok(())
    }
}

// ---------------------------------------------------------------------------
// Tests
// ---------------------------------------------------------------------------

#[cfg(test)]
mod tests {
    use super::*;
    use crate::control_db::tests::test_pool;

    #[test]
    fn member_id_roundtrips_through_uuid() {
        let id = MemberId::new();
        assert_eq!(id.as_bytes().len(), 16);
        let copy = MemberId::from(*id.as_uuid());
        assert_eq!(copy, id);
    }

    #[test]
    fn plan_id_roundtrips_through_uuid() {
        let uuid = Uuid::now_v7();
        let pid = PlanId::from(uuid);
        assert_eq!(pid.as_uuid(), &uuid);
    }

    #[test]
    fn tenant_role_str_round_trip() {
        use std::str::FromStr;
        for role in [
            crate::control_db::TenantRole::Owner,
            crate::control_db::TenantRole::Admin,
            crate::control_db::TenantRole::Viewer,
        ] {
            assert_eq!(
                crate::control_db::TenantRole::from_str(role.as_str()).unwrap(),
                role
            );
        }
        assert!(crate::control_db::TenantRole::from_str("guest").is_err());
    }

    async fn test_db() -> ControlDb {
        let pool = test_pool().await;
        ControlDb::new(pool).await.expect("ControlDb::new")
    }

    pub(super) async fn insert_tenant(db: &ControlDb, slug: &str, email: &str) -> Vec<u8> {
        let id = TenantId::new();
        sqlx::query(
            "INSERT INTO tenants (id, name, slug, owner_email, plan_id, status, db_path) \
             SELECT ?1, ?2, ?3, ?4, id, 'active', ?5 FROM tenant_plans WHERE name = 'dev'",
        )
        .bind(id.as_bytes())
        .bind(format!("{slug}-name"))
        .bind(slug)
        .bind(email)
        .bind(format!("{slug}.db"))
        .execute(db.pool())
        .await
        .expect("insert_tenant");
        id.as_bytes().to_vec()
    }

    #[tokio::test]
    async fn tenant_by_slug_found() {
        let db = test_db().await;
        insert_tenant(&db, "acme-corp", "owner@acme.com").await;
        let tenant = db.tenant_by_slug("acme-corp").await.expect("query");
        assert!(tenant.is_some());
        assert_eq!(tenant.unwrap().slug, "acme-corp");
    }

    #[tokio::test]
    async fn tenant_by_slug_not_found() {
        let db = test_db().await;
        let tenant = db.tenant_by_slug("no-such").await.expect("query");
        assert!(tenant.is_none());
    }

    #[tokio::test]
    async fn tenant_by_id_found() {
        let db = test_db().await;
        let id_bytes = insert_tenant(&db, "beta-corp", "owner@beta.com").await;
        let uuid = Uuid::from_slice(&id_bytes).unwrap();
        let tenant = db.tenant_by_id(&TenantId::from(uuid)).await.expect("query");
        assert!(tenant.is_some());
        assert_eq!(tenant.unwrap().id, id_bytes);
    }

    #[tokio::test]
    async fn tenant_by_owner_email() {
        let db = test_db().await;
        insert_tenant(&db, "corp-one", "shared@example.com").await;
        insert_tenant(&db, "corp-two", "shared@example.com").await;
        let tenants = db
            .tenant_by_owner_email("shared@example.com")
            .await
            .expect("query");
        assert_eq!(tenants.len(), 2);
    }

    // --- Commit 2: simple mutations ---

    #[tokio::test]
    async fn update_name_persists() {
        let db = test_db().await;
        let id_bytes = insert_tenant(&db, "rename-me", "owner@example.com").await;
        let uuid = Uuid::from_slice(&id_bytes).unwrap();
        let tid = TenantId::from(uuid);
        db.update_tenant_name(&tid, "Renamed Corp".into())
            .await
            .expect("update_name");
        let tenant = db.tenant_by_id(&tid).await.expect("query").unwrap();
        assert_eq!(tenant.name, "Renamed Corp");
    }

    #[tokio::test]
    async fn suspend_sets_status() {
        let db = test_db().await;
        let id_bytes = insert_tenant(&db, "suspend-me", "owner@example.com").await;
        let uuid = Uuid::from_slice(&id_bytes).unwrap();
        let tid = TenantId::from(uuid);
        db.suspend_tenant(&tid).await.expect("suspend");
        let tenant = db.tenant_by_id(&tid).await.expect("query").unwrap();
        assert_eq!(tenant.status, TenantStatus::Suspended);
    }

    #[tokio::test]
    async fn delete_sets_status() {
        let db = test_db().await;
        let id_bytes = insert_tenant(&db, "delete-me", "owner@example.com").await;
        let uuid = Uuid::from_slice(&id_bytes).unwrap();
        let tid = TenantId::from(uuid);
        db.delete_tenant(&tid).await.expect("delete");
        let tenant = db.tenant_by_id(&tid).await.expect("query").unwrap();
        assert_eq!(tenant.status, TenantStatus::Deleted);
    }

    #[tokio::test]
    async fn update_name_unknown_id() {
        let db = test_db().await;
        let tid = TenantId::new();
        let err = db
            .update_tenant_name(&tid, "Ghost".into())
            .await
            .err()
            .expect("expected error");
        assert!(matches!(err, SaasError::TenantNotFound));
    }

    // --- Commit 3: provisioning + update_slug ---

    fn test_builder_config() -> TenantBuilderConfig {
        TenantBuilderConfig {
            mfa_key: [1u8; 32],
            signing_key: [2u8; 32],
            csrf_key: [3u8; 32],
            base_domain: "test.local".into(),
            is_production: false,
            email_sender: None,
            event_sink: None,
            event_sink_factory: None,
            mau_sink: None,
            email_sender_factory: None,
        }
    }

    #[test]
    fn tenant_cookie_name_prod_uses_host_prefix() {
        assert_eq!(tenant_cookie_name(true), "__Host-allowthem_session");
    }

    #[test]
    fn tenant_cookie_name_dev_drops_prefix() {
        assert_eq!(tenant_cookie_name(false), "allowthem_session");
    }

    #[tokio::test]
    async fn provision_prod_handle_emits_host_prefixed_cookie() {
        let db = test_db().await;
        let dir = tempfile::tempdir().expect("tempdir");
        let config = TenantBuilderConfig {
            is_production: true,
            ..test_builder_config()
        };

        let result = db
            .provision_tenant(
                "Prod Co".into(),
                "prodco".into(),
                "owner@prodco.com".into(),
                dir.path(),
                &config,
            )
            .await
            .expect("provision_tenant");

        // Build a cookie value via the new tenant handle; assert __Host- prefix,
        // Secure flag, and absence of Domain attribute.
        let token = allowthem_core::sessions::generate_token();
        let cookie = result.ath.session_cookie(&token);
        assert!(
            cookie.starts_with("__Host-allowthem_session="),
            "expected __Host-allowthem_session prefix, got: {cookie}"
        );
        assert!(
            cookie.contains("; Secure"),
            "Secure flag required for __Host-: {cookie}"
        );
        assert!(
            !cookie.contains("Domain="),
            "no Domain= attribute allowed for __Host-: {cookie}"
        );
    }

    #[tokio::test]
    async fn provision_happy_path() {
        let db = test_db().await;
        let dir = tempfile::tempdir().expect("tempdir");
        let config = test_builder_config();

        let result = db
            .provision_tenant(
                "Happy Corp".into(),
                "happy-corp".into(),
                "owner@happy.com".into(),
                dir.path(),
                &config,
            )
            .await
            .expect("provision_tenant");

        let tenant = db
            .tenant_by_slug("happy-corp")
            .await
            .expect("query")
            .expect("tenant must exist");
        assert_eq!(tenant.name, "Happy Corp");

        let db_file = dir.path().join(&tenant.db_path);
        assert!(db_file.exists(), "tenant db file must exist");

        assert!(!result.client_id.is_empty());
        assert!(!result.client_secret.as_str().is_empty());

        // ath handle alive — ping the DB
        let _count: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM allowthem_applications")
            .fetch_one(result.ath.db().pool())
            .await
            .expect("db ping");

        // tenant_members owner row was inserted in the same control-plane tx.
        let (role, accepted_at): (String, Option<String>) = sqlx::query_as(
            "SELECT role, accepted_at FROM tenant_members \
             WHERE tenant_id = ?1 AND email = ?2",
        )
        .bind(tenant.id.as_slice())
        .bind(&tenant.owner_email)
        .fetch_one(db.pool())
        .await
        .expect("owner member row");
        assert_eq!(role, "owner");
        assert!(
            accepted_at.is_some(),
            "owner accepted_at must be set on signup-time provisioning"
        );
    }

    #[tokio::test]
    async fn provision_slug_conflict() {
        let db = test_db().await;
        let dir = tempfile::tempdir().expect("tempdir");
        let config = test_builder_config();

        db.provision_tenant(
            "First".into(),
            "clash-slug".into(),
            "a@example.com".into(),
            dir.path(),
            &config,
        )
        .await
        .expect("first provision");

        let err = db
            .provision_tenant(
                "Second".into(),
                "clash-slug".into(),
                "b@example.com".into(),
                dir.path(),
                &config,
            )
            .await
            .err()
            .expect("expected error");

        assert!(matches!(err, SaasError::SlugTaken));
    }

    #[tokio::test]
    async fn provision_rolls_back_owner_member_on_file_failure() {
        // If the SQLite file open fails after the tenants/tenant_members
        // INSERTs, the control-plane transaction must be rolled back so the
        // tenants table doesn't carry an orphan row and tenant_members has
        // no leftover owner pointing at a non-existent tenant.
        let db = test_db().await;
        let config = test_builder_config();

        // Use a regular file as the "directory" — SqlitePool::connect_with
        // will fail because joining a filename onto a regular file produces
        // an invalid path.
        let bad = tempfile::NamedTempFile::new().expect("tempfile");
        let bad_dir = bad.path();

        let result = db
            .provision_tenant(
                "Atomic".into(),
                "atomic".into(),
                "owner@atomic.com".into(),
                bad_dir,
                &config,
            )
            .await;
        assert!(result.is_err(), "expected provision failure");

        let tenants_count: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM tenants")
            .fetch_one(db.pool())
            .await
            .expect("count tenants");
        assert_eq!(
            tenants_count, 0,
            "tenants row must be rolled back on file-open failure"
        );

        let members_count: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM tenant_members")
            .fetch_one(db.pool())
            .await
            .expect("count members");
        assert_eq!(
            members_count, 0,
            "tenant_members owner row must be rolled back on file-open failure"
        );
    }

    #[tokio::test]
    async fn provision_slug_invalid() {
        let db = test_db().await;
        let dir = tempfile::tempdir().expect("tempdir");
        let config = test_builder_config();

        let err = db
            .provision_tenant(
                "Bad".into(),
                "12abc".into(),
                "x@example.com".into(),
                dir.path(),
                &config,
            )
            .await
            .err()
            .expect("expected error");

        assert!(matches!(err, SaasError::SlugInvalid(_)));
    }

    #[tokio::test]
    async fn provision_slug_reserved() {
        let db = test_db().await;
        let dir = tempfile::tempdir().expect("tempdir");
        let config = test_builder_config();

        let err = db
            .provision_tenant(
                "Admin".into(),
                "admin".into(),
                "x@example.com".into(),
                dir.path(),
                &config,
            )
            .await
            .err()
            .expect("expected error");

        assert!(matches!(err, SaasError::SlugReserved));
    }

    #[tokio::test]
    async fn provision_unwind_no_row_on_slug_conflict() {
        let db = test_db().await;
        let dir = tempfile::tempdir().expect("tempdir");
        let config = test_builder_config();

        db.provision_tenant(
            "First".into(),
            "conflict-test".into(),
            "a@example.com".into(),
            dir.path(),
            &config,
        )
        .await
        .expect("first provision");

        let _ = db
            .provision_tenant(
                "Second".into(),
                "conflict-test".into(),
                "b@example.com".into(),
                dir.path(),
                &config,
            )
            .await;

        let count: i64 =
            sqlx::query_scalar("SELECT COUNT(*) FROM tenants WHERE slug = 'conflict-test'")
                .fetch_one(db.pool())
                .await
                .expect("count query");
        assert_eq!(count, 1, "slug conflict must not leave a partial row");
    }

    #[tokio::test]
    async fn update_slug_no_sessions() {
        let db = test_db().await;
        let dir = tempfile::tempdir().expect("tempdir");
        let config = test_builder_config();

        let result = db
            .provision_tenant(
                "Rename Corp".into(),
                "rename-corp".into(),
                "owner@rename.com".into(),
                dir.path(),
                &config,
            )
            .await
            .expect("provision");

        let tid = TenantId::from(result.tenant.id_as_uuid().unwrap());
        db.update_tenant_slug(&tid, "renamed-corp".into(), result.ath.db().pool())
            .await
            .expect("update_slug should succeed with no sessions");

        let tenant = db
            .tenant_by_id(&tid)
            .await
            .expect("query")
            .expect("tenant must exist");
        assert_eq!(tenant.slug, "renamed-corp");

        // Hold ath alive through all assertions.
        drop(result.ath);
    }

    #[tokio::test]
    async fn update_slug_with_sessions() {
        let db = test_db().await;
        let dir = tempfile::tempdir().expect("tempdir");
        let config = test_builder_config();

        let result = db
            .provision_tenant(
                "Session Corp".into(),
                "session-corp".into(),
                "owner@session.com".into(),
                dir.path(),
                &config,
            )
            .await
            .expect("provision");

        // Insert a user then a session to simulate first-login having occurred.
        let user_id = uuid::Uuid::now_v7().to_string();
        sqlx::query("INSERT INTO allowthem_users (id, email) VALUES (?1, 'test@session.com')")
            .bind(&user_id)
            .execute(result.ath.db().pool())
            .await
            .expect("insert user");
        let session_id = uuid::Uuid::now_v7().to_string();
        sqlx::query(
            "INSERT INTO allowthem_sessions \
             (id, user_id, token_hash, expires_at) \
             VALUES (?1, ?2, 'fakehash', strftime('%Y-%m-%dT%H:%M:%fZ','now','+1 day'))",
        )
        .bind(&session_id)
        .bind(&user_id)
        .execute(result.ath.db().pool())
        .await
        .expect("insert session");

        let tid = TenantId::from(result.tenant.id_as_uuid().unwrap());
        let err = db
            .update_tenant_slug(&tid, "new-slug".into(), result.ath.db().pool())
            .await
            .err()
            .expect("expected error");

        assert!(matches!(err, SaasError::SlugChangeAfterFirstLogin));

        // Hold ath alive through all assertions.
        drop(result.ath);
    }
}