UserAuthority.cs

Go to the documentation of this file.

using System;
using System.Collections.Generic;
using System.Diagnostics.CodeAnalysis;
using System.Linq;
using System.Threading;
using System.Threading.Tasks;
 
using GreenDonut;
 
using HotChocolate.Subscriptions;
 
using Microsoft.AspNetCore.Authorization;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.Logging;
using Microsoft.Extensions.Options;
 
using Tgstation.Server.Api;
using Tgstation.Server.Api.Models;
using Tgstation.Server.Api.Models.Request;
using Tgstation.Server.Api.Models.Response;
using Tgstation.Server.Api.Rights;
using Tgstation.Server.Common.Extensions;
using Tgstation.Server.Host.Authority.Core;
using Tgstation.Server.Host.Configuration;
using Tgstation.Server.Host.Database;
using Tgstation.Server.Host.Extensions;
using Tgstation.Server.Host.Models;
using Tgstation.Server.Host.Models.Transformers;
using Tgstation.Server.Host.Security;
using Tgstation.Server.Host.Security.RightsEvaluation;
 
namespace Tgstation.Server.Host.Authority
{
    sealed class UserAuthority : AuthorityBase, IUserAuthority
    {
        readonly IUsersDataLoader usersDataLoader;
 
        readonly IOAuthConnectionsDataLoader oAuthConnectionsDataLoader;
 
        readonly IOidcConnectionsDataLoader oidcConnectionsDataLoader;
 
        readonly ISystemIdentityFactory systemIdentityFactory;
 
        readonly IPermissionsUpdateNotifyee permissionsUpdateNotifyee;
 
        readonly ICryptographySuite cryptographySuite;
 
        readonly ISessionInvalidationTracker sessionInvalidationTracker;
 
        readonly ITopicEventSender topicEventSender;
 
        readonly IClaimsPrincipalAccessor claimsPrincipalAccessor;
 
        readonly IOptionsSnapshot<GeneralConfiguration> generalConfigurationOptions;
 
        readonly IOptionsSnapshot<SecurityConfiguration> securityConfigurationOptions;
 
        [DataLoader]
        public static Task<Dictionary<long, User>> GetUsers(
            IReadOnlyList<long> ids,
            IDatabaseContext databaseContext,
            CancellationToken cancellationToken)
        {
            ArgumentNullException.ThrowIfNull(ids);
            ArgumentNullException.ThrowIfNull(databaseContext);
 
            return databaseContext
                .Users
                .Where(x => ids.Contains(x.Id!.Value))
                .ToDictionaryAsync(user => user.Id!.Value, cancellationToken);
        }
 
        [DataLoader]
        public static async ValueTask<ILookup<long, GraphQL.Types.OAuth.OAuthConnection>> GetOAuthConnections(
            IReadOnlyList<long> userIds,
            IDatabaseContext databaseContext,
            CancellationToken cancellationToken)
        {
            ArgumentNullException.ThrowIfNull(userIds);
            ArgumentNullException.ThrowIfNull(databaseContext);
 
            var list = await databaseContext
                .OAuthConnections
                .Where(x => userIds.Contains(x.User!.Id!.Value))
                .ToListAsync(cancellationToken);
 
            return list.ToLookup(
                oAuthConnection => oAuthConnection.UserId,
                x => new GraphQL.Types.OAuth.OAuthConnection
                {
                    ExternalUserId = x.ExternalUserId!,
                    Provider = x.Provider,
                });
        }
 
        [DataLoader]
        public static async ValueTask<ILookup<long, GraphQL.Types.OAuth.OidcConnection>> GetOidcConnections(
            IReadOnlyList<long> userIds,
            IDatabaseContext databaseContext,
            CancellationToken cancellationToken)
        {
            ArgumentNullException.ThrowIfNull(userIds);
            ArgumentNullException.ThrowIfNull(databaseContext);
 
            var list = await databaseContext
                .OidcConnections
                .Where(x => userIds.Contains(x.User!.Id!.Value))
                .ToListAsync(cancellationToken);
 
            return list.ToLookup(
                oidcConnection => oidcConnection.UserId,
                x => new GraphQL.Types.OAuth.OidcConnection
                {
                    ExternalUserId = x.ExternalUserId!,
                    SchemeKey = x.SchemeKey!,
                });
        }
 
        static AuthorityResponse<UpdatedUser>? CheckValidName(UserUpdateRequest model, bool newUser)
        {
            var userInvalidWithNullName = newUser && model.Name == null && model.SystemIdentifier == null;
            if (userInvalidWithNullName || (model.Name != null && String.IsNullOrWhiteSpace(model.Name)))
                return BadRequest<UpdatedUser>(ErrorCode.UserMissingName);
 
            model.Name = model.Name?.Trim();
            if (model.Name != null && model.Name.Contains(':', StringComparison.InvariantCulture))
                return BadRequest<UpdatedUser>(ErrorCode.UserColonInName);
            return null;
        }
 
        public UserAuthority(
            IDatabaseContext databaseContext,
            ILogger<UserAuthority> logger,
            IUsersDataLoader usersDataLoader,
            IOAuthConnectionsDataLoader oAuthConnectionsDataLoader,
            IOidcConnectionsDataLoader oidcConnectionsDataLoader,
            ISystemIdentityFactory systemIdentityFactory,
            IPermissionsUpdateNotifyee permissionsUpdateNotifyee,
            ICryptographySuite cryptographySuite,
            ISessionInvalidationTracker sessionInvalidationTracker,
            ITopicEventSender topicEventSender,
            IClaimsPrincipalAccessor claimsPrincipalAccessor,
            IOptionsSnapshot<GeneralConfiguration> generalConfigurationOptions,
            IOptionsSnapshot<SecurityConfiguration> securityConfigurationOptions)
            : base(
                  databaseContext,
                  logger)
        {
            this.usersDataLoader = usersDataLoader ?? throw new ArgumentNullException(nameof(usersDataLoader));
            this.oAuthConnectionsDataLoader = oAuthConnectionsDataLoader ?? throw new ArgumentNullException(nameof(oAuthConnectionsDataLoader));
            this.oidcConnectionsDataLoader = oidcConnectionsDataLoader ?? throw new ArgumentNullException(nameof(oidcConnectionsDataLoader));
            this.systemIdentityFactory = systemIdentityFactory ?? throw new ArgumentNullException(nameof(systemIdentityFactory));
            this.permissionsUpdateNotifyee = permissionsUpdateNotifyee ?? throw new ArgumentNullException(nameof(permissionsUpdateNotifyee));
            this.cryptographySuite = cryptographySuite ?? throw new ArgumentNullException(nameof(cryptographySuite));
            this.sessionInvalidationTracker = sessionInvalidationTracker ?? throw new ArgumentNullException(nameof(sessionInvalidationTracker));
            this.topicEventSender = topicEventSender ?? throw new ArgumentNullException(nameof(topicEventSender));
            this.claimsPrincipalAccessor = claimsPrincipalAccessor ?? throw new ArgumentNullException(nameof(claimsPrincipalAccessor));
            this.generalConfigurationOptions = generalConfigurationOptions ?? throw new ArgumentNullException(nameof(generalConfigurationOptions));
            this.securityConfigurationOptions = securityConfigurationOptions ?? throw new ArgumentNullException(nameof(securityConfigurationOptions));
        }
 
        static bool BadCreateRequestChecks(
            UserCreateRequest createRequest,
            bool? needZeroLengthPasswordWithOAuthConnections,
            [NotNullWhen(true)] out AuthorityResponse<UpdatedUser>? failResponse)
        {
            if (createRequest.OAuthConnections?.Any(x => x == null) == true)
            {
                failResponse = BadRequest<UpdatedUser>(ErrorCode.ModelValidationFailure);
                return true;
            }
 
            var hasNonNullPassword = createRequest.Password != null;
            var hasNonNullSystemIdentifier = createRequest.SystemIdentifier != null;
            var hasOAuthConnections = (createRequest.OAuthConnections?.Count > 0) == true;
            if ((hasNonNullPassword && hasNonNullSystemIdentifier)
                || (!hasNonNullPassword && !hasNonNullSystemIdentifier && !hasOAuthConnections))
            {
                failResponse = BadRequest<UpdatedUser>(ErrorCode.UserMismatchPasswordSid);
                return true;
            }
 
            var hasZeroLengthPassword = createRequest.Password?.Length == 0;
            if (needZeroLengthPasswordWithOAuthConnections.HasValue)
            {
                if (needZeroLengthPasswordWithOAuthConnections.Value)
                {
                    if (createRequest.OAuthConnections == null)
                        throw new InvalidOperationException($"Expected {nameof(UserCreateRequest.OAuthConnections)} to be set here!");
 
                    if (createRequest.OAuthConnections.Count == 0)
                    {
                        failResponse = BadRequest<UpdatedUser>(ErrorCode.ModelValidationFailure);
                        return true;
                    }
                }
                else if (hasZeroLengthPassword)
                {
                    failResponse = BadRequest<UpdatedUser>(ErrorCode.ModelValidationFailure);
                    return true;
                }
            }
 
            if (createRequest.Group != null && createRequest.PermissionSet != null)
            {
                failResponse = BadRequest<UpdatedUser>(ErrorCode.UserGroupAndPermissionSet);
                return true;
            }
 
            createRequest.Name = createRequest.Name?.Trim();
            if (createRequest.Name?.Length == 0)
                createRequest.Name = null;
 
            if (!(createRequest.Name == null ^ createRequest.SystemIdentifier == null))
            {
                failResponse = BadRequest<UpdatedUser>(ErrorCode.UserMismatchNameSid);
                return true;
            }
 
            failResponse = CheckValidName(createRequest, true);
            return failResponse != null;
        }
 
        public RequirementsGated<AuthorityResponse<User>> Read(CancellationToken cancellationToken)
            => new(
                () => Enumerable.Empty<IAuthorizationRequirement>(),
                () => GetIdImpl(claimsPrincipalAccessor.User.RequireTgsUserId(), true, false, cancellationToken));
 
        public RequirementsGated<AuthorityResponse<User>> GetId(long id, bool includeJoins, bool allowSystemUser, CancellationToken cancellationToken)
            => new(
                () =>
                {
                    if (id != claimsPrincipalAccessor.User.GetTgsUserId())
                        return Enumerable.Empty<IAuthorizationRequirement>();
 
                    return new List<IAuthorizationRequirement>
                    {
                        Flag(AdministrationRights.ReadUsers),
                    };
                },
                () => GetIdImpl(id, includeJoins, allowSystemUser, cancellationToken));
 
        public RequirementsGated<IQueryable<User>> Queryable(bool includeJoins)
            => new(
                () => Flag(AdministrationRights.ReadUsers),
                () => ValueTask.FromResult(Queryable(includeJoins, false)));
 
        public RequirementsGated<AuthorityResponse<GraphQL.Types.OAuth.OAuthConnection[]>> OAuthConnections(long userId, CancellationToken cancellationToken)
            => new(
                () => claimsPrincipalAccessor.User.GetTgsUserId() != userId
                    ? Flag(AdministrationRights.ReadUsers)
                    : null,
                async () => new AuthorityResponse<GraphQL.Types.OAuth.OAuthConnection[]>(
                    await oAuthConnectionsDataLoader.LoadRequiredAsync(userId, cancellationToken)));
 
        public RequirementsGated<AuthorityResponse<GraphQL.Types.OAuth.OidcConnection[]>> OidcConnections(long userId, CancellationToken cancellationToken)
            => new(
                () => claimsPrincipalAccessor.User.GetTgsUserId() != userId
                    ? Flag(AdministrationRights.ReadUsers)
                    : null,
                async () => new AuthorityResponse<GraphQL.Types.OAuth.OidcConnection[]>(
                await oidcConnectionsDataLoader.LoadRequiredAsync(userId, cancellationToken)));
 
#pragma warning disable CA1506 // TODO: Decomplexify
        public RequirementsGated<AuthorityResponse<UpdatedUser>> Create(
            UserCreateRequest createRequest,
            bool? needZeroLengthPasswordWithOAuthConnections,
            CancellationToken cancellationToken)
#pragma warning restore CA1506
            => new(
                () => Flag(AdministrationRights.WriteUsers),
                async authorizationService =>
                {
                    ArgumentNullException.ThrowIfNull(createRequest);
 
                    if (BadCreateRequestChecks(createRequest, needZeroLengthPasswordWithOAuthConnections, out var failResponse))
                        return failResponse;
 
                    var totalUsers = await DatabaseContext
                        .Users
                        .CountAsync(cancellationToken);
                    if (totalUsers >= generalConfigurationOptions.Value.UserLimit)
                        return Conflict<UpdatedUser>(ErrorCode.UserLimitReached);
 
                    var dbUser = await CreateNewUserFromModel(
                        createRequest,
                        cancellationToken);
                    if (dbUser == null)
                        return Gone<UpdatedUser>();
 
                    if (createRequest.SystemIdentifier != null)
                        try
                        {
                            using var sysIdentity = await systemIdentityFactory.CreateSystemIdentity(dbUser, cancellationToken);
                            if (sysIdentity == null)
                                return Gone<UpdatedUser>();
                            dbUser.Name = sysIdentity.Username;
                            dbUser.SystemIdentifier = sysIdentity.Uid;
                        }
                        catch (NotImplementedException ex)
                        {
                            Logger.LogTrace(ex, "System identities not implemented!");
                            return new AuthorityResponse<UpdatedUser>(
                                new ErrorMessageResponse(ErrorCode.RequiresPosixSystemIdentity),
                                HttpFailureResponse.NotImplemented);
                        }
                    else
                    {
                        var hasZeroLengthPassword = createRequest.Password?.Length == 0;
                        var hasOAuthConnections = (createRequest.OAuthConnections?.Count > 0) == true;
 
                        // special case allow PasswordHash to be null by setting Password to "" if OAuthConnections are set
                        if (!(needZeroLengthPasswordWithOAuthConnections != false && hasZeroLengthPassword && hasOAuthConnections))
                        {
                            var result = TrySetPassword(dbUser, createRequest.Password!, true);
                            if (result != null)
                                return result;
                        }
                    }
 
                    dbUser.CanonicalName = User.CanonicalizeName(dbUser.Name!);
 
                    DatabaseContext.Users.Add(dbUser);
 
                    await DatabaseContext.Save(cancellationToken);
 
                    Logger.LogInformation("Created new user {name} ({id})", dbUser.Name, dbUser.Id);
 
                    var responseTask = UpdatedUserResponse(authorizationService, dbUser, HttpSuccessResponse.Created);
 
                    await SendUserUpdatedTopics(dbUser);
 
                    return await responseTask;
                });
 
#pragma warning disable CA1502
#pragma warning disable CA1506 // TODO: Decomplexify
        public RequirementsGated<AuthorityResponse<UpdatedUser>> Update(UserUpdateRequest model, CancellationToken cancellationToken)
#pragma warning restore CA1502
#pragma warning restore CA1506
            => new(
                () =>
                {
                    RightsConditional<AdministrationRights>? conditional = null;
 
                    // Ensure they are only trying to edit things they have perms for (system identity change will trigger a bad request)
                    if (model.OidcConnections != null || model.OAuthConnections != null)
                        conditional = Flag(AdministrationRights.EditOwnServiceConnections);
 
                    if (model.Password != null && model.Id == claimsPrincipalAccessor.User.GetTgsUserId())
                    {
                        var newFlag = Flag(AdministrationRights.EditOwnPassword);
                        if (conditional != null)
                            conditional = And(conditional, newFlag);
                        else
                            conditional = newFlag;
                    }
 
                    if (conditional != null)
                        conditional = Or(conditional, Flag(AdministrationRights.WriteUsers));
                    else if (model.Enabled.HasValue
                        || model.Group != null
                        || model.Name != null
                        || model.PermissionSet != null)
                        conditional = Flag(AdministrationRights.WriteUsers);
 
                    return conditional;
                },
                async authorizationService =>
                {
                    ArgumentNullException.ThrowIfNull(model);
 
                    if (!model.Id.HasValue || model.OAuthConnections?.Any(x => x == null) == true)
                        return BadRequest<UpdatedUser>(ErrorCode.ModelValidationFailure);
 
                    if (model.Group != null && model.PermissionSet != null)
                        return BadRequest<UpdatedUser>(ErrorCode.UserGroupAndPermissionSet);
 
                    var userQuery = DatabaseContext
                        .Users
                        .Where(x => x.Id == model.Id)
                        .Include(x => x.CreatedBy)
                        .Include(x => x.OAuthConnections)
                        .Include(x => x.OidcConnections)
                        .Include(x => x.Group!)
                            .ThenInclude(x => x.PermissionSet)
                        .Include(x => x.PermissionSet)
                        .FirstOrDefaultAsync(cancellationToken);
 
                    var originalUser = await userQuery;
 
                    if (originalUser == default)
                        return NotFound<UpdatedUser>();
 
                    if (originalUser.CanonicalName == User.CanonicalizeName(User.TgsSystemUserName))
                        return Forbid<UpdatedUser>();
 
                    var originalUserHasSid = originalUser.SystemIdentifier != null;
                    var invalidateSessions = false;
                    if (originalUserHasSid && originalUser.PasswordHash != null)
                    {
                        // cleanup from https://github.com/tgstation/tgstation-server/issues/1528
                        Logger.LogDebug("System user ID {userId}'s PasswordHash is polluted, updating database.", originalUser.Id);
                        originalUser.PasswordHash = null;
 
                        invalidateSessions = true;
                    }
 
                    if (model.SystemIdentifier != null && model.SystemIdentifier != originalUser.SystemIdentifier)
                        return BadRequest<UpdatedUser>(ErrorCode.UserSidChange);
 
                    if (model.Password != null)
                    {
                        if (originalUserHasSid)
                            return BadRequest<UpdatedUser>(ErrorCode.UserMismatchPasswordSid);
 
                        var result = TrySetPassword(originalUser, model.Password, false);
                        if (result != null)
                            return result;
 
                        invalidateSessions = true;
                    }
 
                    if (model.Name != null && User.CanonicalizeName(model.Name) != originalUser.CanonicalName)
                        return BadRequest<UpdatedUser>(ErrorCode.UserNameChange);
 
                    if (model.OAuthConnections != null
                        && (model.OAuthConnections.Count != originalUser.OAuthConnections!.Count
                        || !model.OAuthConnections.All(x => originalUser.OAuthConnections.Any(y => y.Provider == x.Provider && y.ExternalUserId == x.ExternalUserId))))
                    {
                        if (securityConfigurationOptions.Value.OidcStrictMode)
                            return BadRequest<UpdatedUser>(ErrorCode.BadUserEditDueToOidcStrictMode);
 
                        if (originalUser.CanonicalName == User.CanonicalizeName(DefaultCredentials.AdminUserName))
                            return BadRequest<UpdatedUser>(ErrorCode.AdminUserCannotHaveServiceConnection);
 
                        if (model.OAuthConnections.Count == 0 && originalUser.PasswordHash == null && originalUser.SystemIdentifier == null)
                            return BadRequest<UpdatedUser>(ErrorCode.CannotRemoveLastAuthenticationOption);
 
                        DatabaseContext.OAuthConnections.RemoveRange(originalUser.OAuthConnections);
                        originalUser.OAuthConnections.Clear();
 
                        foreach (var updatedConnection in model.OAuthConnections)
                            originalUser.OAuthConnections.Add(new Models.OAuthConnection
                            {
                                Provider = updatedConnection.Provider,
                                ExternalUserId = updatedConnection.ExternalUserId,
                            });
                    }
 
                    if (model.OidcConnections != null
                        && (model.OidcConnections.Count != originalUser.OidcConnections!.Count
                        || !model.OidcConnections.All(x => originalUser.OidcConnections.Any(y => y.SchemeKey == x.SchemeKey && y.ExternalUserId == x.ExternalUserId))))
                    {
                        if (securityConfigurationOptions.Value.OidcStrictMode)
                            return BadRequest<UpdatedUser>(ErrorCode.BadUserEditDueToOidcStrictMode);
 
                        if (originalUser.CanonicalName == User.CanonicalizeName(DefaultCredentials.AdminUserName))
                            return BadRequest<UpdatedUser>(ErrorCode.AdminUserCannotHaveServiceConnection);
 
                        if (model.OidcConnections.Count == 0 && originalUser.PasswordHash == null && originalUser.SystemIdentifier == null)
                            return BadRequest<UpdatedUser>(ErrorCode.CannotRemoveLastAuthenticationOption);
 
                        DatabaseContext.OidcConnections.RemoveRange(originalUser.OidcConnections);
                        originalUser.OidcConnections.Clear();
                        foreach (var updatedConnection in model.OidcConnections)
                            originalUser.OidcConnections.Add(new Models.OidcConnection
                            {
                                SchemeKey = updatedConnection.SchemeKey,
                                ExternalUserId = updatedConnection.ExternalUserId,
                            });
                    }
 
                    if (model.Group != null)
                    {
                        if (securityConfigurationOptions.Value.OidcStrictMode)
                            return BadRequest<UpdatedUser>(ErrorCode.BadUserEditDueToOidcStrictMode);
 
                        originalUser.Group = await DatabaseContext
                            .Groups
                            .Where(x => x.Id == model.Group.Id)
                            .Include(x => x.PermissionSet)
                            .FirstOrDefaultAsync(cancellationToken);
 
                        if (originalUser.Group == default)
                            return Gone<UpdatedUser>();
 
                        DatabaseContext.Groups.Attach(originalUser.Group);
                        if (originalUser.PermissionSet != null)
                        {
                            Logger.LogInformation("Deleting permission set {permissionSetId}...", originalUser.PermissionSet.Id);
                            DatabaseContext.PermissionSets.Remove(originalUser.PermissionSet);
                            originalUser.PermissionSet = null;
                        }
                    }
                    else if (model.PermissionSet != null)
                    {
                        if (securityConfigurationOptions.Value.OidcStrictMode)
                            return BadRequest<UpdatedUser>(ErrorCode.BadUserEditDueToOidcStrictMode);
 
                        if (originalUser.PermissionSet == null)
                        {
                            Logger.LogTrace("Creating new permission set...");
                            originalUser.PermissionSet = new Models.PermissionSet();
                        }
 
                        originalUser.PermissionSet.AdministrationRights = model.PermissionSet.AdministrationRights ?? AdministrationRights.None;
                        originalUser.PermissionSet.InstanceManagerRights = model.PermissionSet.InstanceManagerRights ?? InstanceManagerRights.None;
 
                        originalUser.Group = null;
                        originalUser.GroupId = null;
                    }
 
                    var fail = CheckValidName(model, false);
                    if (fail != null)
                        return fail;
 
                    originalUser.Name = model.Name ?? originalUser.Name;
 
                    if (model.Enabled.HasValue)
                    {
                        if (securityConfigurationOptions.Value.OidcStrictMode)
                            return BadRequest<UpdatedUser>(ErrorCode.BadUserEditDueToOidcStrictMode);
 
                        invalidateSessions = originalUser.Require(x => x.Enabled) && !model.Enabled.Value;
                        originalUser.Enabled = model.Enabled.Value;
                    }
 
                    if (invalidateSessions)
                        sessionInvalidationTracker.UserModifiedInvalidateSessions(originalUser);
 
                    await DatabaseContext.Save(cancellationToken);
 
                    Logger.LogInformation("Updated user {userName} ({userId})", originalUser.Name, originalUser.Id);
 
                    var responseTask = UpdatedUserResponse(authorizationService, originalUser, HttpSuccessResponse.Ok);
 
                    ValueTask sessionInvalidationTask;
                    if (invalidateSessions)
                        sessionInvalidationTask = permissionsUpdateNotifyee.UserDisabled(originalUser, cancellationToken);
                    else
                        sessionInvalidationTask = ValueTask.CompletedTask;
 
                    await ValueTaskExtensions.WhenAll(SendUserUpdatedTopics(originalUser), sessionInvalidationTask);
 
                    return await responseTask;
                });
 
        public RequirementsGated<Projectable<User, TResult>> GetId<TResult>(long id, bool allowSystemUser, CancellationToken cancellationToken)
            where TResult : class
            => new(
                () =>
                {
                    if (id != claimsPrincipalAccessor.User.GetTgsUserId())
                        return Enumerable.Empty<IAuthorizationRequirement>();
 
                    return new List<IAuthorizationRequirement>
                    {
                        Flag(AdministrationRights.ReadUsers),
                    };
                },
                () => ValueTask.FromResult(
                    Projectable<User, TResult>.Create(
                        Queryable(true, allowSystemUser)
                            .Where(user => user.Id == id)
                            .TagWith("User by ID"),
                        projected => new ProjectedPair<string, TResult>
                        {
                            Queried = projected.Queried.CanonicalName!,
                            Result = projected.Result,
                        },
                        projected =>
                        {
                            if (projected == default)
                                return NotFound<TResult>();
 
                            string canonicalName = projected.Queried;
                            if (!allowSystemUser && canonicalName == User.CanonicalizeName(User.TgsSystemUserName))
                                return Forbid<TResult>();
 
                            return new AuthorityResponse<TResult>(projected.Result);
                        },
                        cancellationToken)));
 
        async ValueTask<AuthorityResponse<User>> GetIdImpl(long id, bool includeJoins, bool allowSystemUser, CancellationToken cancellationToken)
        {
            User? user;
            if (includeJoins)
            {
                var queryable = Queryable(true, true);
 
                user = await queryable.FirstOrDefaultAsync(
                    dbModel => dbModel.Id == id,
                    cancellationToken);
            }
            else
                user = await usersDataLoader.LoadAsync(id, cancellationToken);
 
            if (user == default)
                return NotFound<User>();
 
            if (!allowSystemUser && user.CanonicalName == User.CanonicalizeName(User.TgsSystemUserName))
                return Forbid<User>();
 
            return new AuthorityResponse<User>(user);
        }
 
        async ValueTask<AuthorityResponse<UpdatedUser>> UpdatedUserResponse(
            Security.IAuthorizationService authorizationService,
            User user,
            HttpSuccessResponse successResponse)
        {
            // return id only if not a self update and cannot read users
            var userId = user.Require(u => u.Id);
            var canReadBack = claimsPrincipalAccessor.User.GetTgsUserId() == userId
                || (await authorizationService.AuthorizeAsync(
                    [Flag(AdministrationRights.ReadUsers)])).Succeeded;
 
            return new AuthorityResponse<UpdatedUser>(
                canReadBack
                    ? new UpdatedUser(user)
                    : new UpdatedUser(userId),
                successResponse);
        }
 
        ValueTask SendUserUpdatedTopics(User user)
            => ValueTaskExtensions.WhenAll(
                GraphQL.Subscriptions.UserSubscriptions.UserUpdatedTopics(
                    user.Require(x => x.Id))
                    .Select(topic => topicEventSender.SendAsync(
                        topic,
                        ((IApiTransformable<User, GraphQL.Types.User, UserGraphQLTransformer>)user).ToApi(),
                        CancellationToken.None))); // DCT: Operation should always run
 
        IQueryable<User> Queryable(bool includeJoins, bool allowSystemUser)
        {
            var tgsUserCanonicalName = User.CanonicalizeName(User.TgsSystemUserName);
            IQueryable<User> queryable = DatabaseContext
                .Users;
 
            if (!allowSystemUser)
                queryable = queryable
                    .Where(user => user.CanonicalName != tgsUserCanonicalName);
 
            if (includeJoins)
                queryable = queryable
                    .Include(x => x.CreatedBy)
                    .Include(x => x.OAuthConnections)
                    .Include(x => x.OidcConnections)
                    .Include(x => x.Group!)
                        .ThenInclude(x => x.PermissionSet)
                    .Include(x => x.PermissionSet);
 
            return queryable;
        }
 
        async ValueTask<User> CreateNewUserFromModel(Api.Models.Internal.UserApiBase model, CancellationToken cancellationToken)
        {
            Models.PermissionSet? permissionSet = null;
            UserGroup? group = null;
            if (model.Group != null)
                group = await DatabaseContext
                    .Groups
                    .Where(x => x.Id == model.Group.Id)
                    .Include(x => x.PermissionSet)
                    .FirstOrDefaultAsync(cancellationToken);
            else
                permissionSet = new Models.PermissionSet
                {
                    AdministrationRights = model.PermissionSet?.AdministrationRights ?? AdministrationRights.None,
                    InstanceManagerRights = model.PermissionSet?.InstanceManagerRights ?? InstanceManagerRights.None,
                };
 
            /*
            var currentUser = new User
            {
                Id = claimsPrincipalAccessor.User.GetTgsUserId(),
            };
            */
 
            // Temporary workaround while we work to remove authentication context
            var currentUser = DatabaseContext.Users.Local.First(
                user => user.Id == claimsPrincipalAccessor.User.GetTgsUserId());
 
            DatabaseContext.Users.Attach(currentUser);
 
            return new User
            {
                CreatedAt = DateTimeOffset.UtcNow,
                CreatedBy = currentUser,
                Enabled = model.Enabled ?? false,
                PermissionSet = permissionSet,
                Group = group,
                Name = model.Name,
                SystemIdentifier = model.SystemIdentifier,
                OAuthConnections = model
                    .OAuthConnections
                    ?.Select(x => new Models.OAuthConnection
                    {
                        Provider = x.Provider,
                        ExternalUserId = x.ExternalUserId,
                    })
                    .ToList()
                    ?? new List<Models.OAuthConnection>(),
                OidcConnections = model
                    .OidcConnections
                    ?.Select(x => new Models.OidcConnection
                    {
                        SchemeKey = x.SchemeKey,
                        ExternalUserId = x.ExternalUserId,
                    })
                    .ToList()
                    ?? new List<Models.OidcConnection>(),
            };
        }
 
        AuthorityResponse<UpdatedUser>? TrySetPassword(User dbUser, string newPassword, bool newUser)
        {
            newPassword ??= String.Empty;
            if (newPassword.Length < generalConfigurationOptions.Value.MinimumPasswordLength)
                return new AuthorityResponse<UpdatedUser>(
                    new ErrorMessageResponse(ErrorCode.UserPasswordLength)
                    {
                        AdditionalData = $"Required password length: {generalConfigurationOptions.Value.MinimumPasswordLength}",
                    },
                    HttpFailureResponse.BadRequest);
            cryptographySuite.SetUserPassword(dbUser, newPassword, newUser);
            return null;
        }
    }
}