mark_deleted: atomic last-admin guard; review minors

crates/adapters/sqlite/src/repositories/users/mod.rs

@@ -169,15 +169,32 @@ impl UserRepository for SqliteUserRepository {
             .begin()
             .await
             .map_err(crate::shared::map_sqlx_error)?;
-        let stamped =
-            sqlx::query("UPDATE users SET deleted_at = ? WHERE id = ? AND deleted_at IS NULL")
-                .bind(Utc::now().format("%Y-%m-%dT%H:%M:%SZ").to_string())
-                .bind(&id_str)
-                .execute(&mut *tx)
-                .await
-                .map_err(crate::shared::map_sqlx_error)?;
+        // The last-admin guard lives in this single statement, so two admins
+        // deleting each other concurrently cannot both pass it: the write lock
+        // serialises them and the loser sees the winner's tombstone.
+        let stamped = sqlx::query(
+            "UPDATE users SET deleted_at = ?1 WHERE id = ?2 AND deleted_at IS NULL
+             AND (role != 'admin' OR EXISTS (
+                 SELECT 1 FROM users WHERE role = 'admin' AND deleted_at IS NULL AND id != ?2))",
+        )
+        .bind(Utc::now().format("%Y-%m-%dT%H:%M:%SZ").to_string())
+        .bind(&id_str)
+        .execute(&mut *tx)
+        .await
+        .map_err(crate::shared::map_sqlx_error)?;
         if stamped.rows_affected() == 0 {
-            return Err(DomainError::NotFound("User not found".into()));
+            let live: i64 = sqlx::query_scalar(
+                "SELECT COUNT(*) FROM users WHERE id = ? AND deleted_at IS NULL",
+            )
+            .bind(&id_str)
+            .fetch_one(&mut *tx)
+            .await
+            .map_err(crate::shared::map_sqlx_error)?;
+            return Err(if live == 0 {
+                DomainError::NotFound("User not found".into())
+            } else {
+                DomainError::Conflict("the last active admin cannot be deleted".into())
+            });
         }
         sqlx::query(
             "INSERT OR IGNORE INTO retired_usernames (username) SELECT username FROM users WHERE id = ?",

crates/adapters/sqlite/tests/repositories/user_repository_test.rs

@@ -114,13 +114,19 @@ async fn add_session(pool: &SqlitePool, user_id: &UserId, token: &str) {
 
 #[tokio::test]
 async fn marking_a_user_deleted_hides_them_from_every_lookup() {
-    let (_, repo) = setup().await;
+    let (pool, repo) = setup().await;
     let admin =
         domain::testing::test_user_with_role(UserId::generate(), domain::models::UserRole::Admin);
     repo.save(&admin).await.unwrap();
     let other = test_user("other");
     repo.save(&other).await.unwrap();
-    assert_eq!(repo.count_active_admins().await.unwrap(), 1);
+    // A second admin, so the first is not the last one standing.
+    sqlx::query("UPDATE users SET role = 'admin' WHERE id = ?")
+        .bind(other.id().value().to_string())
+        .execute(&pool)
+        .await
+        .unwrap();
+    assert_eq!(repo.count_active_admins().await.unwrap(), 2);
 
     repo.mark_deleted(admin.id(), &[deleted_event(&admin)])
         .await
@@ -138,7 +144,7 @@ async fn marking_a_user_deleted_hides_them_from_every_lookup() {
     let emails: Vec<_> = listed.iter().map(|u| u.email()).collect();
     assert!(emails.contains(&other.email().value()));
     assert!(!emails.contains(&admin.email().value()));
-    assert_eq!(repo.count_active_admins().await.unwrap(), 0);
+    assert_eq!(repo.count_active_admins().await.unwrap(), 1);
     // The purge can still read the tombstone; a live user is not one.
     assert!(
         repo.find_tombstoned_by_id(admin.id())
@@ -214,3 +220,58 @@ async fn retired_names_match_case_insensitively() {
     assert!(repo.is_username_retired(&lower).await.unwrap());
     assert!(repo.is_username_retired(&upper).await.unwrap());
 }
+
+#[tokio::test]
+async fn marking_the_last_admin_deleted_is_refused_atomically() {
+    let dir = tempfile::tempdir().unwrap();
+    let opts = sqlx::sqlite::SqliteConnectOptions::new()
+        .filename(dir.path().join("u.db"))
+        .create_if_missing(true)
+        .journal_mode(sqlx::sqlite::SqliteJournalMode::Wal)
+        .busy_timeout(std::time::Duration::from_secs(5));
+    let pool = sqlx::sqlite::SqlitePoolOptions::new()
+        .max_connections(4)
+        .connect_with(opts)
+        .await
+        .unwrap();
+    sqlite::migrate(&pool).await.unwrap();
+    let repo = std::sync::Arc::new(SqliteUserRepository::new(pool.clone()));
+    let a = test_user("admin_a");
+    let b = test_user("admin_b");
+    repo.save(&a).await.unwrap();
+    repo.save(&b).await.unwrap();
+    sqlx::query("UPDATE users SET role = 'admin' WHERE id IN (?, ?)")
+        .bind(a.id().value().to_string())
+        .bind(b.id().value().to_string())
+        .execute(&pool)
+        .await
+        .unwrap();
+    assert_eq!(repo.count_active_admins().await.unwrap(), 2);
+
+    let (ra, rb) = (repo.clone(), repo.clone());
+    let (ida, idb) = (a.id().clone(), b.id().clone());
+    let (ea, eb) = (deleted_event(&a), deleted_event(&b));
+    let (x, y) = tokio::join!(
+        tokio::spawn(async move { ra.mark_deleted(&ida, &[ea]).await }),
+        tokio::spawn(async move { rb.mark_deleted(&idb, &[eb]).await }),
+    );
+    let results = [x.unwrap(), y.unwrap()];
+
+    assert_eq!(
+        results.iter().filter(|r| r.is_ok()).count(),
+        1,
+        "{results:?}"
+    );
+    assert!(
+        results
+            .iter()
+            .any(|r| matches!(r, Err(domain::errors::DomainError::Conflict(_)))),
+        "{results:?}"
+    );
+    assert_eq!(repo.count_active_admins().await.unwrap(), 1);
+    assert_eq!(
+        count(&pool, "event_queue").await,
+        1,
+        "loser enqueued nothing"
+    );
+}