[WPB-5990] Introduce user subsystem

[akshaymankar]

https://wearezeta.atlassian.net/browse/WPB-5990

Checklist

• Add a new entry in an appropriate subdirectory of changelog.d
• Read and follow the PR guidelines

[fisx]

i started to pull this PR apart, more PRs with trivial, but noisy changes coming up!

[mdimjasevic]

I have a general organisation question: why do we introduce these two effects: both Wire.UserStore and Wire.UserSubsystem? Shouldn't they be one effect instead?

[fisx]

      refresh /access
        invalid-cookie:                                                                      FAIL
          Exception: Assertions failed:
           2: Just "expired" not in Just "{\"code\":403,\"label\":\"invalid-credentials\",\"message\":\"Invalid token\"}"
          
          Response was:
          
          Response {responseStatus = Status {statusCode = 403, statusMessage = "Forbidden"}, responseVersion = HTTP/1.1, responseHeaders = [("Transfer-Encoding","chunked"),("Date","Tue, 30 Apr 2024 10:54:15 GMT"),("Server","Warp/3.3.30"),("Content-Encoding","gzip"),("Content-Type","application/json"),("Vary","Accept-Encoding")], responseBody = Just "{\"code\":403,\"label\":\"invalid-credentials\",\"message\":\"Invalid token\"}", responseCookieJar = CJ {expose = []}, responseClose' = ResponseClose, responseOriginalRequest = Request {
            host                 = "brig.test-k0zibhkkw1ey.svc.cluster.local"
            port                 = 8080
            secure               = False
            requestHeaders       = [("Cookie","zuid=u-26cLooGfPnoln43d-hSgLn5mo4AfM2kKl-kJ_nsqcGLfH2gLrsZ5wYQGRgNLLyIxvGT3m4y2HVtcitNzcJDA==.v=1.k=1.d=1714474455.t=u.l=.u=e7b3aacd-4b2e-4a4b-8810-d46dc3cd9804.r=620db778")]
            path                 = "/access"
            queryString          = ""
            method               = "POST"
            proxy                = Nothing
            rawBody              = False
            redirectCount        = 10
            responseTimeout      = ResponseTimeoutDefault
            requestVersion       = HTTP/1.1
            proxySecureMode      = ProxySecureWithConnect
          }
          , responseEarlyHints = []}
          CallStack (from HasCallStack):
            error, called at src/Bilge/Assert.hs:91:5 in bilge-0.22.0-5UDVUBJ4yLy2nT3LW1wv9Q:Bilge.Assert
            <!!, called at src/Bilge/Assert.hs:109:19 in bilge-0.22.0-5UDVUBJ4yLy2nT3LW1wv9Q:Bilge.Assert
            !!!, called at test/integration/API/User/Auth.hs:673:64 in main:API.User.Auth
          Use -p '(!/turn/&&!/user.auth.cookies.limit/)&&$0=="Brig API Integration.user.auth.refresh /access.invalid-cookie"' to rerun this test only.

this looks like an actual change in behavior, so we may want to fix this in the prod code, not in the tests. or not. maybe something about deleting expired users faster now than before?

[fisx]

I have a general organisation question: why do we introduce these two effects: both Wire.UserStore and Wire.UserSubsystem? Shouldn't they be one effect instead?

UserStore is a low-level persistence effect implemented in cassandra. UserSubsystem is a top-level effect that is implemented in terms of more fine-grained polysemy effects, one of them being UserStore.

if we replace the UserStore implementation with something MVar-based, we can test UserSubsystem without the need for cassandra. if UserStore would happen internally in UserSubsystem.Interpreter, it would be unclear how to replace the cassandra interpreter in a robust way for the tests.

[MangoIV]

just some nitpicks, I guess, feel free to ignore :)

[MangoIV]

@pcapriotti now that we're porting this, have we thought about putting a concrete type here (i.e. [])? passing dictionaries is expensive and Foldable basically says "this is isomorphic to []"

[mdimjasevic]

There are a few things I believe have to be addressed. Comments are inlined.

[mdimjasevic]

Suggested change

	Wire.FederationAPIAccess.FederationAPIAccess Wire.API.Federation.Client.FederatorClient,
	FederationAPIAccess FederatorClient,

I suppose we can import these things such that we can write the much shorter version.

[fisx]

      refresh /access
        invalid-cookie:                                                                      FAIL
          Exception: Assertions failed:
           2: Just "expired" not in Just "{\"code\":403,\"label\":\"invalid-credentials\",\"message\":\"Invalid token\"}"
          
          Response was:
          
          Response {responseStatus = Status {statusCode = 403, statusMessage = "Forbidden"}, responseVersion = HTTP/1.1, responseHeaders = [("Transfer-Encoding","chunked"),("Date","Tue, 30 Apr 2024 10:54:15 GMT"),("Server","Warp/3.3.30"),("Content-Encoding","gzip"),("Content-Type","application/json"),("Vary","Accept-Encoding")], responseBody = Just "{\"code\":403,\"label\":\"invalid-credentials\",\"message\":\"Invalid token\"}", responseCookieJar = CJ {expose = []}, responseClose' = ResponseClose, responseOriginalRequest = Request {
            host                 = "brig.test-k0zibhkkw1ey.svc.cluster.local"
            port                 = 8080
            secure               = False
            requestHeaders       = [("Cookie","zuid=u-26cLooGfPnoln43d-hSgLn5mo4AfM2kKl-kJ_nsqcGLfH2gLrsZ5wYQGRgNLLyIxvGT3m4y2HVtcitNzcJDA==.v=1.k=1.d=1714474455.t=u.l=.u=e7b3aacd-4b2e-4a4b-8810-d46dc3cd9804.r=620db778")]
            path                 = "/access"
            queryString          = ""
            method               = "POST"
            proxy                = Nothing
            rawBody              = False
            redirectCount        = 10
            responseTimeout      = ResponseTimeoutDefault
            requestVersion       = HTTP/1.1
            proxySecureMode      = ProxySecureWithConnect
          }
          , responseEarlyHints = []}
          CallStack (from HasCallStack):
            error, called at src/Bilge/Assert.hs:91:5 in bilge-0.22.0-5UDVUBJ4yLy2nT3LW1wv9Q:Bilge.Assert
            <!!, called at src/Bilge/Assert.hs:109:19 in bilge-0.22.0-5UDVUBJ4yLy2nT3LW1wv9Q:Bilge.Assert
            !!!, called at test/integration/API/User/Auth.hs:673:64 in main:API.User.Auth
          Use -p '(!/turn/&&!/user.auth.cookies.limit/)&&$0=="Brig API Integration.user.auth.refresh /access.invalid-cookie"' to rerun this test only.

this looks like an actual change in behavior, so we may want to fix this in the prod code, not in the tests. or not. maybe something about deleting expired users faster now than before?

never mind, this is actually happening in other branches, too.

[MangoIV]

woooooooooooohooooooooooooo 🎉