@johnnyboy11234/esg-idea-contest 0.1.0 → 0.2.1

package/backend/internal/server/errors.go

@@ -0,0 +1,80 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"log/slog"
+	"maps"
+	"net/http"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/audit"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+// Rejecter writes track-B audit rows. *audit.Service implements it.
+type Rejecter interface {
+	RecordRejected(ctx context.Context, e audit.Event)
+}
+
+// ErrorAdapter is the one place that turns a handler's error into a response
+// and, when the error asks for it, into a track-B audit row (Backend.md §7).
+// No other code calls RecordRejected.
+type ErrorAdapter struct {
+	Audit Rejecter
+	Log   *slog.Logger // nil = discard
+}
+
+// Write answers err as problem+json. When err wraps a *web.Error with an
+// AuditReason, the rejected attempt is recorded first (best effort: the row's
+// failure never changes the response). Errors without a reason are not audited,
+// and neither is anything that is not a *web.Error (it answers 500).
+func (a ErrorAdapter) Write(w http.ResponseWriter, r *http.Request, err error) {
+	var e *web.Error
+	if !errors.As(err, &e) {
+		web.WriteError(w, r, err)
+		return
+	}
+	if e.AuditReason != "" {
+		a.record(r, e)
+	}
+	web.WriteProblem(w, r, e)
+}
+
+func (a ErrorAdapter) record(r *http.Request, e *web.Error) {
+	log := a.Log
+	if log == nil {
+		log = slog.New(slog.DiscardHandler)
+	}
+	if a.Audit == nil || e.AuditAction == "" {
+		// A programming error: the attempt cannot be recorded. Say so loudly,
+		// but still answer the client.
+		log.ErrorContext(r.Context(), "audit: rejected attempt without action or recorder",
+			"code", string(e.Code), "reason", e.AuditReason)
+		return
+	}
+	outcome := audit.Outcome(e.AuditOutcome)
+	if outcome == "" {
+		outcome = audit.Denied
+	}
+	detail := map[string]string{}
+	maps.Copy(detail, e.AuditDetail)
+	detail["reason"] = e.AuditReason // the reason always wins over a detail key
+	after, _ := json.Marshal(detail) // map of strings cannot fail
+	ev := audit.Event{
+		Action:     audit.Action(e.AuditAction),
+		Outcome:    outcome,
+		TargetType: audit.TargetType(e.AuditTargetType),
+		TargetID:   e.AuditTargetID,
+		Method:     r.Method,
+		Route:      web.RoutePattern(r),
+		Status:     e.Status,
+		ErrorCode:  string(e.Code),
+		IP:         web.ClientIP(r),
+		UserAgent:  r.UserAgent(),
+
+		SubmittedEmpNo: e.AuditSubmittedEmpNo,
+		After:          after,
+	}
+	a.Audit.RecordRejected(r.Context(), ev)
+}

package/backend/internal/server/errors_test.go

@@ -0,0 +1,116 @@
+package server_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/audit"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/server"
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/web"
+)
+
+type fakeRejecter struct{ got []audit.Event }
+
+func (f *fakeRejecter) RecordRejected(_ context.Context, e audit.Event) { f.got = append(f.got, e) }
+
+func serve(t *testing.T, ad server.ErrorAdapter, err error) *httptest.ResponseRecorder {
+	t.Helper()
+	r := chi.NewRouter()
+	r.Get("/ideas/{id}", func(w http.ResponseWriter, req *http.Request) { ad.Write(w, req, err) })
+	req := httptest.NewRequest("GET", "/ideas/123", nil)
+	req.RemoteAddr = "192.0.2.7:5555"
+	req.Header.Set("User-Agent", "ua/1")
+	rec := httptest.NewRecorder()
+	r.ServeHTTP(rec, req)
+	return rec
+}
+
+func TestAdapterWithReasonRecordsDenied(t *testing.T) {
+	id := uuid.New()
+	e := web.NewError(web.CodeNotFound, "resource not found")
+	e.AuditReason, e.AuditAction = "NOT_FOUND", "IDEA_VIEW"
+	e.AuditTargetType, e.AuditTargetID = "IDEA", id
+	f := &fakeRejecter{}
+
+	rec := serve(t, server.ErrorAdapter{Audit: f}, fmt.Errorf("wrapped: %w", e))
+
+	if rec.Code != 404 {
+		t.Fatalf("status = %d", rec.Code)
+	}
+	if len(f.got) != 1 {
+		t.Fatalf("rows = %d, want 1", len(f.got))
+	}
+	g := f.got[0]
+	if g.Outcome != audit.Denied || g.Action != audit.IdeaView || g.TargetType != audit.TargetIdea || g.TargetID != id ||
+		g.Method != "GET" || g.Route != "/ideas/{id}" || g.Status != 404 || g.ErrorCode != "NOT_FOUND" ||
+		g.IP.String() != "192.0.2.7" || g.UserAgent != "ua/1" || string(g.After) != `{"reason":"NOT_FOUND"}` {
+		t.Fatalf("event = %+v (after %s)", g, g.After)
+	}
+	if body := rec.Body.String(); contains(body, "reason") {
+		t.Fatalf("reason leaked to client: %s", body)
+	}
+}
+
+func TestAdapterOutcomeOverride(t *testing.T) {
+	e := web.NewError(web.CodeLoginThrottled, "")
+	e.AuditReason, e.AuditAction, e.AuditOutcome = "KEY_LOCKED", "AUTH_LOGIN", "THROTTLED"
+	f := &fakeRejecter{}
+	serve(t, server.ErrorAdapter{Audit: f}, e)
+	if len(f.got) != 1 || f.got[0].Outcome != audit.Throttled {
+		t.Fatalf("got %+v", f.got)
+	}
+}
+
+func TestAdapterWithoutReasonRecordsNothing(t *testing.T) {
+	f := &fakeRejecter{}
+	rec := serve(t, server.ErrorAdapter{Audit: f}, web.NewError(web.CodeEmailTaken, "x"))
+	if rec.Code != 409 || len(f.got) != 0 {
+		t.Fatalf("status %d rows %d", rec.Code, len(f.got))
+	}
+}
+
+func TestAdapterPlainErrorIs500AndUnaudited(t *testing.T) {
+	f := &fakeRejecter{}
+	rec := serve(t, server.ErrorAdapter{Audit: f}, errors.New("db password=hunter2"))
+	if rec.Code != 500 || len(f.got) != 0 || contains(rec.Body.String(), "hunter2") {
+		t.Fatalf("status %d rows %d body %s", rec.Code, len(f.got), rec.Body)
+	}
+}
+
+func TestAdapterReasonWithoutActionStillAnswers(t *testing.T) {
+	e := web.NewError(web.CodeForbidden, "no")
+	e.AuditReason = "ROLE"
+	f := &fakeRejecter{}
+	rec := serve(t, server.ErrorAdapter{Audit: f}, e)
+	if rec.Code != 403 || len(f.got) != 0 {
+		t.Fatalf("status %d rows %d", rec.Code, len(f.got))
+	}
+}
+
+func contains(s, sub string) bool { return strings.Contains(s, sub) }
+
+func TestAdapterCarriesSubmittedEmpNoAndDetail(t *testing.T) {
+	e := web.NewError(web.CodeEmpNoTaken, "taken")
+	e.AuditReason, e.AuditAction, e.AuditOutcome = "emp_no_taken", "AUTH_REGISTER", "FAILED"
+	e.AuditSubmittedEmpNo = "089290"
+	e.AuditDetail = map[string]string{"empNo": "089290", "reason": "must not override"}
+	f := &fakeRejecter{}
+
+	rec := serve(t, server.ErrorAdapter{Audit: f}, e)
+
+	if rec.Code != 409 || len(f.got) != 1 {
+		t.Fatalf("status %d rows %d", rec.Code, len(f.got))
+	}
+	g := f.got[0]
+	if g.Outcome != audit.Failed || g.SubmittedEmpNo != "089290" || string(g.After) != `{"empNo":"089290","reason":"emp_no_taken"}` {
+		t.Fatalf("event = %+v (after %s)", g, g.After)
+	}
+}

package/backend/internal/shared/db/intx_test.go

@@ -5,6 +5,7 @@ import (
 	"database/sql"
 	"database/sql/driver"
 	"errors"
+	"fmt"
 	"net/http"
 	"testing"
 	"time"
@@ -221,3 +222,27 @@ func TestSQLStateClassNonMySQL(t *testing.T) {
 		t.Error("non-MySQL error must have no class and no contention")
 	}
 }
+
+func TestDuplicateKey(t *testing.T) {
+	dup := func(msg string) error { return fmt.Errorf("wrap: %w", &mysql.MySQLError{Number: 1062, Message: msg}) }
+	cases := []struct {
+		name string
+		err  error
+		key  string
+		ok   bool
+	}{
+		{"plain", dup("Duplicate entry 'a@b' for key 'uq_app_user_email'"), "uq_app_user_email", true},
+		{"table qualified", dup("Duplicate entry '1' for key 'app_user.uq_app_user_emp_no'"), "uq_app_user_emp_no", true},
+		{"value contains the marker", dup("Duplicate entry 'for key ''x' for key 'uq_a'"), "uq_a", true},
+		{"no key in message", dup("boom"), "", true},
+		{"unterminated", dup("Duplicate entry 'x' for key 'uq_a"), "uq_a", true},
+		{"other number", &mysql.MySQLError{Number: 1205}, "", false},
+		{"not a mysql error", errors.New("x"), "", false},
+	}
+	for _, tc := range cases {
+		key, ok := DuplicateKey(tc.err)
+		if key != tc.key || ok != tc.ok {
+			t.Errorf("%s: got (%q, %v), want (%q, %v)", tc.name, key, ok, tc.key, tc.ok)
+		}
+	}
+}

package/backend/internal/shared/db/mysqlerr.go

@@ -2,6 +2,7 @@ package db
 
 import (
 	"errors"
+	"strings"
 
 	"github.com/go-sql-driver/mysql"
 )
@@ -31,3 +32,28 @@ func sqlStateClass(err error) string {
 	}
 	return string(me.SQLState[:2])
 }
+
+const errDupEntry = 1062 // ER_DUP_ENTRY
+
+// DuplicateKey reports whether err is a unique-key violation (1062) and names
+// the violated key, as in "Duplicate entry 'x' for key 'uq_app_user_email'".
+func DuplicateKey(err error) (key string, ok bool) {
+	var me *mysql.MySQLError
+	if !errors.As(err, &me) || me.Number != errDupEntry {
+		return "", false
+	}
+	const marker = "for key '"
+	i := strings.LastIndex(me.Message, marker)
+	if i < 0 {
+		return "", true
+	}
+	rest := me.Message[i+len(marker):]
+	if j := strings.IndexByte(rest, '\''); j >= 0 {
+		rest = rest[:j]
+	}
+	// MariaDB may qualify the key with the table name ("app_user.uq_x").
+	if k := strings.LastIndexByte(rest, '.'); k >= 0 {
+		rest = rest[k+1:]
+	}
+	return rest, true
+}

package/backend/internal/shared/security/security.go

@@ -0,0 +1,102 @@
+// Package security holds the authenticated caller's identity: the Principal
+// built by the session middleware and the context accessors every later layer
+// uses to read it (Backend.md §6). It has no dependencies inside the module so
+// that any package may import it.
+package security
+
+import (
+	"context"
+
+	"github.com/google/uuid"
+)
+
+// Role is an account role (PRD §3). Leader, Member and Applicant are relations
+// to one Idea, not roles.
+type Role string
+
+// The two account roles.
+const (
+	RoleUser  Role = "USER"
+	RoleAdmin Role = "ADMIN"
+)
+
+// Valid reports whether r is one of the two account roles.
+func (r Role) Valid() bool { return r == RoleUser || r == RoleAdmin }
+
+// ActorRole is the role recorded in the audit log (PRD §7): an account role, or
+// ANONYMOUS (no session) or SYSTEM (no caller, e.g. background cleanup).
+type ActorRole string
+
+// The audit actor roles.
+const (
+	ActorUser      ActorRole = "USER"
+	ActorAdmin     ActorRole = "ADMIN"
+	ActorAnonymous ActorRole = "ANONYMOUS"
+	ActorSystem    ActorRole = "SYSTEM"
+)
+
+// Principal is the caller resolved from a valid session. The role is read from
+// the account on every request, never copied into the session (PRD §6.5).
+type Principal struct {
+	UserID uuid.UUID
+	EmpNo  string
+	Role   Role
+}
+
+// IsAdmin reports whether the principal has role ADMIN.
+func (p Principal) IsAdmin() bool { return p.Role == RoleAdmin }
+
+// ActorRole maps the account role to its audit value. An invalid role maps to
+// ANONYMOUS so an unexpected value is never recorded as privileged.
+func (p Principal) ActorRole() ActorRole {
+	switch p.Role {
+	case RoleUser:
+		return ActorUser
+	case RoleAdmin:
+		return ActorAdmin
+	}
+	return ActorAnonymous
+}
+
+type ctxKey int
+
+const (
+	principalKey ctxKey = iota
+	systemKey
+)
+
+// WithPrincipal returns a context carrying p.
+func WithPrincipal(ctx context.Context, p Principal) context.Context {
+	return context.WithValue(ctx, principalKey, p)
+}
+
+// PrincipalFrom returns the principal in ctx; ok is false when there is none.
+func PrincipalFrom(ctx context.Context) (p Principal, ok bool) {
+	p, ok = ctx.Value(principalKey).(Principal)
+	return p, ok
+}
+
+// WithSystem marks ctx as a system action (no caller). A principal in ctx still
+// wins, so a request can never be recorded as SYSTEM by accident.
+func WithSystem(ctx context.Context) context.Context {
+	return context.WithValue(ctx, systemKey, true)
+}
+
+// ActorRoleFrom returns the audit actor role for ctx: the principal's role,
+// else SYSTEM if marked with WithSystem, else ANONYMOUS.
+func ActorRoleFrom(ctx context.Context) ActorRole {
+	if p, ok := PrincipalFrom(ctx); ok {
+		return p.ActorRole()
+	}
+	if sys, _ := ctx.Value(systemKey).(bool); sys {
+		return ActorSystem
+	}
+	return ActorAnonymous
+}
+
+// ActorEmpNo returns the caller's employee ID for the audit log, or "" when
+// there is no principal.
+func ActorEmpNo(ctx context.Context) string {
+	p, _ := PrincipalFrom(ctx)
+	return p.EmpNo
+}

package/backend/internal/shared/security/security_test.go

@@ -0,0 +1,62 @@
+package security_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/google/uuid"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/security"
+)
+
+func TestPrincipalRoundTrip(t *testing.T) {
+	ctx := context.Background()
+	if _, ok := security.PrincipalFrom(ctx); ok {
+		t.Fatal("empty context must have no principal")
+	}
+	want := security.Principal{UserID: uuid.New(), EmpNo: "A123", Role: security.RoleUser}
+	got, ok := security.PrincipalFrom(security.WithPrincipal(ctx, want))
+	if !ok || got != want {
+		t.Fatalf("got %+v, %v", got, ok)
+	}
+}
+
+func TestActorRole(t *testing.T) {
+	bg := context.Background()
+	user := security.Principal{UserID: uuid.New(), EmpNo: "U1", Role: security.RoleUser}
+	admin := security.Principal{UserID: uuid.New(), EmpNo: "A1", Role: security.RoleAdmin}
+	bad := security.Principal{UserID: uuid.New(), EmpNo: "X", Role: "ROOT"}
+
+	tests := []struct {
+		name string
+		ctx  context.Context
+		want security.ActorRole
+		emp  string
+	}{
+		{"anonymous", bg, security.ActorAnonymous, ""},
+		{"user", security.WithPrincipal(bg, user), security.ActorUser, "U1"},
+		{"admin", security.WithPrincipal(bg, admin), security.ActorAdmin, "A1"},
+		{"invalid role is never privileged", security.WithPrincipal(bg, bad), security.ActorAnonymous, "X"},
+		{"system", security.WithSystem(bg), security.ActorSystem, ""},
+		{"principal wins over system", security.WithSystem(security.WithPrincipal(bg, user)), security.ActorUser, "U1"},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := security.ActorRoleFrom(tc.ctx); got != tc.want {
+				t.Errorf("ActorRoleFrom = %q, want %q", got, tc.want)
+			}
+			if got := security.ActorEmpNo(tc.ctx); got != tc.emp {
+				t.Errorf("ActorEmpNo = %q, want %q", got, tc.emp)
+			}
+		})
+	}
+}
+
+func TestRole(t *testing.T) {
+	if !security.RoleUser.Valid() || !security.RoleAdmin.Valid() || security.Role("").Valid() || security.Role("ROOT").Valid() {
+		t.Error("Valid wrong")
+	}
+	if !(security.Principal{Role: security.RoleAdmin}).IsAdmin() || (security.Principal{Role: security.RoleUser}).IsAdmin() {
+		t.Error("IsAdmin wrong")
+	}
+}

package/backend/internal/shared/web/problem.go

@@ -3,6 +3,8 @@ package web
 import (
 	"encoding/json"
 	"net/http"
+
+	"github.com/google/uuid"
 )
 
 // ProblemContentType is the RFC 9457 media type.
@@ -16,15 +18,35 @@ type FieldError struct {
 }
 
 // Error is the one error type handlers and services return. The central
-// adapter turns it into problem+json; AuditReason (set later by the audit PRs)
-// makes the adapter record a track-B row.
+// adapter turns it into problem+json; a non-empty AuditReason makes the adapter
+// record a track-B row (Backend.md §7). Without a reason nothing is audited.
+//
+// The Audit* fields are plain strings because package audit imports web.
 type Error struct {
-	Status      int
-	Code        ErrorCode
-	Detail      string
-	Fields      []FieldError
+	Status int
+	Code   ErrorCode
+	Detail string
+	Fields []FieldError
+	Cause  error
+
+	// AuditReason is the real reason of a rejected attempt (CSRF, role, state,
+	// not-yours, not-found). It is stored in the row's after_json, never sent
+	// to the client.
 	AuditReason string
-	Cause       error
+	// AuditAction is the audit action of the attempted operation, e.g.
+	// "IDEA_VIEW". Required whenever AuditReason is set.
+	AuditAction string
+	// AuditOutcome is DENIED, FAILED or THROTTLED; empty means DENIED.
+	AuditOutcome string
+	// AuditTargetType and AuditTargetID name the resource, when there is one.
+	AuditTargetType string
+	AuditTargetID   uuid.UUID
+	// AuditSubmittedEmpNo is the employee ID typed into a failed registration
+	// or login; the audit package sanitizes it before storing.
+	AuditSubmittedEmpNo string
+	// AuditDetail adds keys to the row's after_json beside "reason". Callers
+	// must not put secrets here.
+	AuditDetail map[string]string
 }
 
 func (e *Error) Error() string {

package/backend/internal/shared/web/request.go

@@ -0,0 +1,27 @@
+package web
+
+import (
+	"net/http"
+	"net/netip"
+
+	"github.com/go-chi/chi/v5"
+)
+
+// RoutePattern is the matched chi pattern (/api/v1/ideas/{id}), never the raw
+// path, so IDs do not leak into the audit log and rows group by route. It is
+// empty when no route matched.
+func RoutePattern(r *http.Request) string {
+	if rc := chi.RouteContext(r.Context()); rc != nil {
+		return rc.RoutePattern()
+	}
+	return ""
+}
+
+// ClientIP is the TCP peer. Trusted-proxy handling is not decided yet.
+func ClientIP(r *http.Request) netip.Addr {
+	ap, err := netip.ParseAddrPort(r.RemoteAddr)
+	if err != nil {
+		return netip.Addr{}
+	}
+	return ap.Addr().Unmap()
+}

package/backend/test/migration/app_user_test.go

@@ -0,0 +1,112 @@
+//go:build integration
+
+// Package migration holds schema-level tests against a real MariaDB with the real migrations.
+package migration_test
+
+import (
+	"database/sql"
+	"strings"
+	"testing"
+
+	"github.com/brian-huanggg/AwardRegistration/backend/internal/shared/dbtest"
+)
+
+const hash = "$2a$10$" + "abcdefghijklmnopqrstuuABCDEFGHIJKLMNOPQRSTUVWXYZ01234" // 53 chars after the prefix
+
+func insert(d *sql.DB, empNo, name string, email any, pw, role string) error {
+	_, err := d.Exec(`INSERT INTO app_user (emp_no, name, email, password_hash, role) VALUES (?,?,?,?,?)`,
+		empNo, name, email, pw, role)
+	return err
+}
+
+func TestAppUserFieldRules(t *testing.T) {
+	d := dbtest.New(t)
+	if len(hash) != 60 {
+		t.Fatalf("test hash has length %d", len(hash))
+	}
+
+	valid := []struct {
+		name, empNo, nm string
+		email           any
+		role            string
+	}{
+		{"user", "089290", "王小明", "a@b", "USER"},
+		{"user 50 code points", "000001", strings.Repeat("名", 50), "x@y.z", "USER"},
+		{"admin without email", "000002", "Admin", nil, "ADMIN"},
+		{"second admin (NULL emails do not collide)", "000003", "Admin 2", nil, "ADMIN"},
+		{"email max length", "000004", "N", strings.Repeat("a", 252) + "@b", "USER"},
+	}
+	for _, c := range valid {
+		if err := insert(d, c.empNo, c.nm, c.email, hash, c.role); err != nil {
+			t.Errorf("%s: want accepted, got %v", c.name, err)
+		}
+	}
+
+	invalid := []struct {
+		name, empNo, nm string
+		email           any
+		pw, role        string
+	}{
+		{"emp_no 5 digits", "12345", "N", "e1@x", hash, "USER"},
+		{"emp_no 7 digits", "1234567", "N", "e2@x", hash, "USER"},
+		{"emp_no letter", "12345a", "N", "e3@x", hash, "USER"},
+		{"emp_no newline", "12345\n", "N", "e4@x", hash, "USER"},
+		{"emp_no fullwidth digit", "12345１", "N", "e5@x", hash, "USER"},
+		{"name empty", "100001", "", "e6@x", hash, "USER"},
+		{"name 51 code points", "100002", strings.Repeat("名", 51), "e7@x", hash, "USER"},
+		{"name control char", "100003", "a\tb", "e8@x", hash, "USER"},
+		{"name slash", "100004", "a/b", "e9@x", hash, "USER"},
+		{"name backslash", "100005", `a\b`, "e10@x", hash, "USER"},
+		{"name pipe", "100006", "a|b", "e11@x", hash, "USER"},
+		{"name quote", "100007", `a"b`, "e12@x", hash, "USER"},
+		{"email upper case", "100008", "N", "A@x", hash, "USER"},
+		{"email space", "100009", "N", "a b@x", hash, "USER"},
+		{"email non-ASCII", "100010", "N", "é@x", hash, "USER"},
+		{"email two @", "100011", "N", "a@b@c", hash, "USER"},
+		{"email no @", "100012", "N", "abc", hash, "USER"},
+		{"email empty local", "100013", "N", "@x", hash, "USER"},
+		{"email empty domain", "100014", "N", "a@", hash, "USER"},
+		{"email trailing newline", "100015", "N", "a@x\n", hash, "USER"},
+		{"email 255 chars", "100016", "N", strings.Repeat("a", 253) + "@b", hash, "USER"},
+		{"user without email", "100017", "N", nil, hash, "USER"},
+		{"admin with email", "100018", "N", "ad@x", hash, "ADMIN"},
+		{"role unknown", "100019", "N", "e13@x", hash, "OWNER"},
+		{"hash cost 12", "100020", "N", "e14@x", "$2a$12$" + hash[7:], "USER"},
+		{"hash plain text", "100021", "N", "e15@x", strings.Repeat("p", 60), "USER"},
+		{"duplicate emp_no", "089290", "N", "e16@x", hash, "USER"},
+		{"duplicate email", "100022", "N", "a@b", hash, "USER"},
+	}
+	for _, c := range invalid {
+		if err := insert(d, c.empNo, c.nm, c.email, c.pw, c.role); err == nil {
+			t.Errorf("%s: want rejected, got accepted", c.name)
+		}
+	}
+}
+
+func TestAppUserEmailUniquenessIsByteExact(t *testing.T) {
+	d := dbtest.New(t)
+	if err := insert(d, "200001", "N", "a@x", hash, "USER"); err != nil {
+		t.Fatal(err)
+	}
+	// Upper case is rejected by the CHECK, so the lower-cased form is the only one that can collide.
+	if err := insert(d, "200002", "N", "a@x", hash, "USER"); err == nil {
+		t.Fatal("duplicate lower-cased email accepted")
+	}
+}
+
+func TestAppUserDefaults(t *testing.T) {
+	d := dbtest.New(t)
+	if err := insert(d, "300001", "N", "d@x", hash, "USER"); err != nil {
+		t.Fatal(err)
+	}
+	var id string
+	var enabled bool
+	var created, updated sql.NullTime
+	if err := d.QueryRow(`SELECT id, enabled, created_at, updated_at FROM app_user WHERE emp_no='300001'`).
+		Scan(&id, &enabled, &created, &updated); err != nil {
+		t.Fatal(err)
+	}
+	if len(id) != 36 || !enabled || !created.Valid || !updated.Valid {
+		t.Fatalf("defaults wrong: id=%q enabled=%v created=%v updated=%v", id, enabled, created, updated)
+	}
+}

package/docs/Adr/0001-Backend-in-go.md

@@ -56,9 +56,9 @@ This document checks what a Go implementation looks like if the current architec
  
 | # | Item |
 |---|---|
-| O1 | **Facts checked on Go 1.26.10.** `encoding/json` (v1) matches field names case-insensitively (`"EMPNO"` fills `empNo`) and, for a duplicate key, the last one wins. `encoding/json/v2` is **still behind `GOEXPERIMENT=jsonv2`** and cannot be imported without it, so it is not used. With the experiment on, v2 rejects duplicate keys and matches names case-sensitively, which is what the PRD wants. `Backend.md` §3 proposes the `Token()` pre-pass plus exact-name field picking. When v2 becomes stable, only the decoder in `shared/web` is replaced; the `test/binding` tests stay. Waiting for owner confirmation of the decoder design. |
-| O2 | Exclude generated code (sqlc, oapi-codegen) from the coverage denominator? Recommended: yes. |
-| O3 | Probe paths: keep the `/actuator/...` paths or switch to `/healthz`-style paths and update the chart. |
+| O1 (= OI-53) | **Facts checked on Go 1.26.10.** `encoding/json` (v1) matches field names case-insensitively (`"EMPNO"` fills `empNo`) and, for a duplicate key, the last one wins. `encoding/json/v2` is **still behind `GOEXPERIMENT=jsonv2`** and cannot be imported without it, so it is not used. With the experiment on, v2 rejects duplicate keys and matches names case-sensitively, which is what the PRD wants. `Backend.md` §3 proposes the `Token()` pre-pass plus exact-name field picking. When v2 becomes stable, only the decoder in `shared/web` is replaced; the `test/binding` tests stay. Waiting for owner confirmation of the decoder design. |
+| O2 (= OI-54) | Exclude generated code (sqlc, oapi-codegen) from the coverage denominator? Recommended: yes. |
+| O3 (= OI-55) | Probe paths: keep the `/actuator/...` paths or switch to `/healthz`-style paths and update the chart. |
  
 ## What adoption requires