Admin Console Service — クリーンアーキテクチャ設計¶

type AdminUser struct {
    ID          AdminID
    Email       Email
    Role        AdminRole
    MFAEnabled  bool
    LastLoginAt *time.Time
    Status      AdminUserStatus // ACTIVE | LOCKED | DISABLED
}


// スコープ判定
func (u *AdminUser) CanPerform(scope AdminScope) bool {
    return u.Role.HasScope(scope)
}

type AdminCommand struct {
    ID          CommandID
    Type        CommandType
    Params      CommandParams
    Status      CommandStatus
    EnqueuedAt  time.Time
    Result      *CommandResult
    AuditRef    AuditID      // Audit Svc との結合子
}

// 不変条件: COMPLETED / FAILED に遷移したら Status は変更不可
func (c *AdminCommand) MarkCompleted(result CommandResult) error {
    if c.Status == CommandStatusCompleted || c.Status == CommandStatusFailed {
        return ErrTerminalStatus
    }
    c.Status = CommandStatusCompleted
    c.Result = &result
    return nil
}

type ApprovalRequest struct {
    ID             RequestID
    Action         ActionType
    RequesterID    AdminID
    ApproverID     *AdminID
    Payload        json.RawMessage
    Status         ApprovalStatus // PENDING | APPROVED | REJECTED | EXPIRED
    ExpiresAt      time.Time
}

// 承認者は申請者と同一不可（SoD: Separation of Duties）
func (r *ApprovalRequest) Approve(approver AdminID, policy ApprovalPolicy) error {
    if approver == r.RequesterID {
        return ErrSelfApprovalDenied
    }
    if time.Now().After(r.ExpiresAt) {
        return ErrExpired
    }
    if !policy.IsApproverEligible(approver, r.Action) {
        return ErrApproverUneligible
    }
    r.ApproverID = &approver
    r.Status = ApprovalStatusApproved
    return nil
}

// usecase/admin/suspend_user.go
package admin

type SuspendUserInteractor struct {
    repo        AdminRepo
    perm        PermissionGateway
    coreSvc     CoreSvcGateway
    approval    ApprovalInteractor
    audit       AuditGateway
    eventPub    EventPublisher
    flagClient  FlagClient // admin.readonly をチェック
}

type SuspendUserInput struct {
    Actor        AdminUser
    TargetUserID UserID
    Reason       string
    Duration     time.Duration
    ApprovalID   *ApprovalID // 既に承認済みなら渡す
}

func (i *SuspendUserInteractor) Execute(ctx context.Context, in SuspendUserInput) (*SuspendUserOutput, error) {
    // 1. Read-Only モード確認
    if enabled, _ := i.flagClient.Bool(ctx, "admin.readonly", false); enabled {
        return nil, ErrReadOnlyMode
    }

    // 2. 権限確認
    if !in.Actor.CanPerform(ScopeUsersSuspend) {
        return nil, ErrForbidden
    }

    // 3. 二段階承認チェック
    if in.ApprovalID == nil {
        // 承認要求を新規発行して戻す
        req, err := i.approval.Request(ctx, ActionSuspendUser, in)
        if err != nil {
            return nil, err
        }
        return &SuspendUserOutput{ApprovalRequestID: &req.ID, Status: "PENDING_APPROVAL"}, nil
    }
    if err := i.approval.VerifyApproved(ctx, *in.ApprovalID, ActionSuspendUser); err != nil {
        return nil, err
    }

    // 4. ドメイン操作（Core Svc 経由で実際に凍結）
    if err := i.coreSvc.SuspendUser(ctx, in.TargetUserID, in.Reason, in.Duration); err != nil {
        return nil, err
    }

    // 5. 監査記録（同期、失敗したら全体失敗）
    action := NewAdminAction(in.Actor.ID, ActionSuspendUser, in.TargetUserID, in)
    if err := i.audit.Write(ctx, action); err != nil {
        // コア側をロールバック
        _ = i.coreSvc.RestoreUser(ctx, in.TargetUserID, "audit-failure-rollback")
        return nil, ErrAuditWriteFailed
    }

    // 6. ドメインイベント発行
    i.eventPub.Publish(ctx, AdminActionExecutedEvent{
        ActorID: in.Actor.ID, Type: ActionSuspendUser, Target: in.TargetUserID,
    })

    return &SuspendUserOutput{Status: "SUSPENDED"}, nil
}

// adapter/gateway/flag_flipt_gateway.go
type FliptFlagGateway struct {
    client flipt.Client
    cb     circuit.Breaker
}

func (g *FliptFlagGateway) UpdateFlag(ctx context.Context, key string, change FlagChange) error {
    err := g.cb.Execute(func() error {
        return g.client.UpdateFlag(ctx, toFliptReq(key, change))
    })
    if errors.Is(err, flipt.ErrNotFound) {
        return domain.ErrFlagNotFound
    }
    return err
}

// cmd/admin-console/main.go
func main() {
    cfg := config.Load()
    ff := openfeature.New(cfg.FlagProvider)

    // アダプタ注入 — Beta/本番で差し替わる唯一の箇所
    queueGateway := buildQueueGateway(cfg, ff)           // BullMQ or OCI Queue
    storageGateway := buildStorageGateway(cfg)           // Garage or OCI Object Storage
    repo := buildAdminRepo(cfg)

    // Interactor 構築
    suspendUC := usecase.NewSuspendUser(repo, permGW, coreGW, approvalUC, auditGW, eventPub, ff)
    // ... 他のユースケース

    // Controller 配線
    router := http.NewRouter(suspendUC, ...)
    server := http.NewServer(cfg.Addr, router)
    server.Run()
}

func TestApprovalRequest_SelfApprovalDenied(t *testing.T) {
    req := NewApprovalRequest(adminA, ActionSuspendUser, payload)
    err := req.Approve(adminA, policy) // 自己承認
    require.ErrorIs(t, err, ErrSelfApprovalDenied)
}

func TestSuspendUser_ReadOnlyMode(t *testing.T) {
    ff := fakeFlagClient{bools: map[string]bool{"admin.readonly": true}}
    uc := NewSuspendUserInteractor(..., ff)
    _, err := uc.Execute(ctx, SuspendUserInput{Actor: adminA, ...})
    require.ErrorIs(t, err, ErrReadOnlyMode)
}

type UnitOfWork interface {
    WithTx(ctx context.Context, fn func(tx Tx) error) error
}

// Use Case 内
return i.uow.WithTx(ctx, func(tx Tx) error {
    if err := i.repo.WithTx(tx).Save(cmd); err != nil { return err }
    if err := i.audit.WithTx(tx).Write(act); err != nil { return err }
    return nil
})