feat(account): upgrade external to internal

src/application/dtos/user_dto.rs

@@ -229,6 +229,23 @@ pub struct RefreshTokenDto {
     pub refresh_token: String,
 }
 
+/// Body for `POST /api/auth/upgrade-to-internal`. Converts an
+/// authenticated external user into an internal user with their own
+/// personal drive.
+///
+/// `password` is optional — semantics decided per deployment:
+///   * If `magic_link` is in `OXICLOUD_AUTH_METHODS` (and OIDC isn't
+///     enabled) → password can be omitted; user remains magic-link-only
+///     for login after upgrade.
+///   * Otherwise → password is required; refusal returns 400
+///     `error_type = "PasswordRequired"`. Without it the upgraded user
+///     would have no login path.
+#[derive(Debug, Serialize, Deserialize, ToSchema)]
+pub struct UpgradeToInternalDto {
+    #[serde(default)]
+    pub password: Option<String>,
+}
+
 /// Authenticated current user data (for use in application services)
 #[derive(Clone, Debug, Serialize, Deserialize, ToSchema)]
 pub struct CurrentUser {

src/application/ports/user_lifecycle.rs

@@ -193,4 +193,32 @@ pub trait UserLifecycleHook: Send + Sync {
         mode: DeletionMode,
         tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
     ) -> Result<(), DomainError>;
+
+    /// Fires after `AuthApplicationService::upgrade_to_internal`
+    /// successfully persists `is_external = false` on the user row —
+    /// the external → internal conversion path. The `user` argument
+    /// reflects the POST-upgrade state (`is_external() == false`,
+    /// `storage_quota_bytes > 0`, `password_hash` maybe stamped).
+    ///
+    /// Load-bearing implementations:
+    ///   * `PersonalDriveLifecycleHook` → provisions the home drive
+    ///     (would have short-circuited on `on_user_created` because
+    ///     the user was external at creation).
+    ///   * `AuditLifecycleHook` → emits `event="auth.user_upgraded"`.
+    ///
+    /// Default: no-op. Hooks that don't care about upgrade don't need
+    /// to opt in — this keeps the trait extension backwards-compatible
+    /// with existing implementations. Do NOT reuse `on_user_created`
+    /// for this event: hooks that observe `last_login_at().is_none()`
+    /// as "first ever" or that clean up magic-link tokens
+    /// (`ExternalIdentityLifecycleHook`) would mis-fire.
+    ///
+    /// Idempotency: fires exactly once per successful upgrade transition
+    /// (guarded by `is_external` toggling). A retried upgrade after a
+    /// crash would hit the `AlreadyInternal` guard in the service and
+    /// this hook wouldn't fire again — so hooks may assume "first
+    /// upgrade" semantics.
+    async fn on_upgraded_to_internal(&self, _user: &User) -> Result<(), DomainError> {
+        Ok(())
+    }
 }

src/application/services/auth_application_service.rs

@@ -1,5 +1,6 @@
 use crate::application::dtos::user_dto::{
-    AuthResponseDto, ChangePasswordDto, LoginDto, RefreshTokenDto, RegisterDto, UserDto,
+    AuthResponseDto, ChangePasswordDto, LoginDto, RefreshTokenDto, RegisterDto,
+    UpgradeToInternalDto, UserDto,
 };
 use crate::application::ports::auth_ports::{
     OidcIdClaims, OidcServicePort, PasswordHasherPort, SessionStoragePort, TokenServicePort,
@@ -1233,6 +1234,147 @@ impl AuthApplicationService {
         Ok(revoked_count)
     }
 
+    /// External → internal account upgrade.
+    ///
+    /// Contract:
+    ///   * Caller must be authenticated as the user being upgraded.
+    ///     Session-elevation is not required — being logged in as
+    ///     yourself IS the proof of intent.
+    ///   * User must be `is_external = true` — else the entity refuses
+    ///     with `UserError::AlreadyInternal`, surfaced as `error_type =
+    ///     "AlreadyInternal"` (409).
+    ///   * OIDC-linked users are refused (the IdP owns their identity).
+    ///   * If `dto.password` is `None`, the deployment MUST have magic-
+    ///     link login enabled — otherwise the upgraded user would have
+    ///     no login path. Refused with `error_type = "PasswordRequired"`
+    ///     (400) in that case.
+    ///   * Domain-allowlist check lives at the HANDLER layer, mirroring
+    ///     the register handler — the service doesn't hold that config.
+    ///
+    /// On success:
+    ///   * User's `is_external` flipped to `false`.
+    ///   * `password_hash` set from the provided password (Argon2id) or
+    ///     left as-is (magic-link-only upgrade).
+    ///   * `storage_quota_bytes` set to the default user quota (capped
+    ///     by disk).
+    ///   * `PersonalDriveLifecycleHook::on_upgraded_to_internal` runs and
+    ///     provisions the home drive + root folder + owner grant via the
+    ///     atomic CTE. Failure at this step is logged but the row update
+    ///     stands — the next login's `on_user_login` safety-net retries
+    ///     provisioning.
+    ///   * `user_flags_cache` invalidated eagerly so per-request guards
+    ///     (WebDAV / CalDAV / CardDAV) observe the new `is_external`
+    ///     within cache-round-trip time, not the 30-second TTL.
+    ///   * Audit log emits `event="user.upgraded_to_internal"` via the
+    ///     `AuditLifecycleHook` on the dispatched event.
+    pub async fn upgrade_to_internal(
+        &self,
+        caller_id: Uuid,
+        dto: UpgradeToInternalDto,
+    ) -> Result<UserDto, DomainError> {
+        let mut user = self.user_storage.get_user_by_id(caller_id).await?;
+
+        // Precondition: caller is currently external. Fast-path 409 so
+        // the audit log carries a clear reason before the entity's own
+        // guard fires.
+        if !user.is_external() {
+            tracing::info!(
+                target: "audit",
+                event = "user.upgrade_rejected",
+                reason = "already_internal",
+                user_id = %user.id(),
+                username = %user.display_for_audit(),
+                "👮🏻‍♂️ upgrade refused: user is already internal",
+            );
+            return Err(DomainError::new(
+                ErrorKind::Conflict,
+                "User",
+                "Account is already internal",
+            ));
+        }
+
+        // OIDC-linked: never. The IdP owns identity and role.
+        if user.is_oidc_user() {
+            tracing::info!(
+                target: "audit",
+                event = "user.upgrade_rejected",
+                reason = "oidc_user",
+                user_id = %user.id(),
+                "👮🏻‍♂️ upgrade refused: OIDC-linked user is managed by the IdP",
+            );
+            return Err(DomainError::new(
+                ErrorKind::AccessDenied,
+                "User",
+                "SSO/OIDC accounts are managed by your identity provider",
+            ));
+        }
+
+        // Password policy composite:
+        //   * Provided → validate + hash.
+        //   * Omitted   → only accepted when magic-link login is on
+        //     for this deployment (otherwise no login path post-upgrade).
+        let password_hash = match dto.password.as_deref() {
+            Some(pw) if !pw.is_empty() => {
+                if pw.len() < 8 {
+                    return Err(DomainError::new(
+                        ErrorKind::InvalidInput,
+                        "User",
+                        "Password must be at least 8 characters long",
+                    ));
+                }
+                Some(self.password_hasher.hash_password(pw).await?)
+            }
+            _ => {
+                if !self.is_magic_link_login_allowed() {
+                    tracing::info!(
+                        target: "audit",
+                        event = "user.upgrade_rejected",
+                        reason = "password_required",
+                        user_id = %user.id(),
+                        "👮🏻‍♂️ upgrade refused: password omitted but magic-link login is not available on this deployment",
+                    );
+                    return Err(DomainError::new(
+                        ErrorKind::InvalidInput,
+                        "User",
+                        "Password is required — magic-link login is not enabled on this deployment",
+                    ));
+                }
+                None
+            }
+        };
+
+        // Quota policy: same as a fresh regular-user signup.
+        let quota = self.capped_quota(&UserRole::User);
+
+        user.promote_to_internal(password_hash, quota)
+            .map_err(|e| {
+                // The entity refuses `AlreadyInternal` here belt-and-braces
+                // against a race with a concurrent upgrade; the pre-check
+                // above already covers the intended path.
+                DomainError::new(
+                    ErrorKind::Conflict,
+                    "User",
+                    format!("Upgrade refused: {}", e),
+                )
+            })?;
+
+        let updated = self.user_storage.update_user(user).await?;
+
+        // Invalidate the flags cache so subsequent per-request guards
+        // observe the new `is_external=false` without waiting for the
+        // 30-second TTL. Same pattern as `change_user_role`.
+        self.user_flags_cache.invalidate(&caller_id);
+
+        // Dispatch — home-drive provisioning happens here. Log-and-
+        // continue: a provisioning failure leaves the row updated and
+        // the next login's safety-net (`on_user_login`) retries.
+        if let Some(lc) = &self.user_lifecycle {
+            lc.dispatch_upgraded_to_internal(&updated).await;
+        }
+
+        Ok(UserDto::from(updated))
+    }
+
     pub async fn change_password(
         &self,
         user_id: Uuid,

src/application/services/folder_service.rs

@@ -962,6 +962,17 @@ impl UserLifecycleHook for PersonalDriveLifecycleHook {
         self.provision_if_needed(user).await
     }
 
+    /// External → internal upgrade. `on_user_created` fired at signup
+    /// with `is_external=true` and short-circuited in
+    /// `provision_if_needed`. The user is now internal — same helper
+    /// runs, but this time the `is_external` guard passes through and
+    /// the atomic CTE creates their default drive + root folder +
+    /// owner grant. Idempotent by construction: a rerun after a partial
+    /// failure hits the `find_default_for_user` short-circuit.
+    async fn on_upgraded_to_internal(&self, user: &User) -> Result<(), DomainError> {
+        self.provision_if_needed(user).await
+    }
+
     async fn on_user_logout(&self, _user: &User, _reason: LogoutReason) -> Result<(), DomainError> {
         // Drives don't react to logout. Explicit no-op per the
         // "no defaults" convention.

src/application/services/user_lifecycle_service.rs

@@ -62,6 +62,28 @@ impl UserLifecycleService {
         }
     }
 
+    /// Upgraded: log-and-continue. Called by
+    /// `AuthApplicationService::upgrade_to_internal` after the
+    /// `is_external = false` UPDATE persists. Same log-and-continue
+    /// semantics as `dispatch_created` — the row is already updated,
+    /// hook failure at (e.g.) home-drive provisioning is recoverable
+    /// on the next login via `PersonalDriveLifecycleHook::on_user_login`
+    /// (its safety-net path already handles the "user is internal but
+    /// no drive yet" case idempotently).
+    pub async fn dispatch_upgraded_to_internal(&self, user: &User) {
+        for h in &self.hooks {
+            if let Err(e) = h.on_upgraded_to_internal(user).await {
+                tracing::error!(
+                    target: "user_lifecycle",
+                    hook = h.name(),
+                    user_id = %user.id(),
+                    error = %e,
+                    "on_upgraded_to_internal failed; drive provisioning will retry on next login"
+                );
+            }
+        }
+    }
+
     /// Login: log-and-continue. Same reasoning as `dispatch_created`.
     /// Must fire BEFORE `user.register_login()` so that hooks observing
     /// `last_login_at().is_none()` correctly detect the first-ever login.
@@ -199,6 +221,19 @@ impl UserLifecycleHook for AuditLifecycleHook {
         );
         Ok(())
     }
+
+    async fn on_upgraded_to_internal(&self, user: &User) -> Result<(), DomainError> {
+        // Post-upgrade state — `is_external` is already `false` here
+        // (the service persisted before dispatching), so we don't log
+        // it as a field; the event name carries the transition.
+        tracing::info!(
+            target: "audit",
+            event = "user.upgraded_to_internal",
+            user_id = %user.id(),
+            username = %user.display_for_audit(),
+        );
+        Ok(())
+    }
 }
 
 // ─────────────────────────────────────────────────────────────────────────────