Stop reporting a failed login lookup as "Invalid Email"

GetUserByAuthname / GetUserByContactNo / GetUserLogin discarded the
Scan error, so a database that could not answer — down, pool exhausted,
or booted without its config (2026-07-20) — came back as uid 0 and every
user was told their email was wrong.

One lookup, GetUserLogin, now returns an error; sql.ErrNoRows is "not
found" and anything else reaches the service, which answers 500 "Login
is temporarily unavailable" and logs the cause. 409 "Invalid Email" is
unchanged for a genuine no-match: the console reads that exact shape as
"not registered". NULL password/role columns scan through sql.Null* so
they do not become 500s.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

repositories/userRepository.go

@@ -1,6 +1,8 @@
 package repositories
 
 import (
+	"database/sql"
+	"errors"
 	"fmt"
 	"strings"
 
@@ -15,13 +17,11 @@ type UserRepository interface {
 	Login(user models.User) (models.UserInfo, error)
 	FindUserID(authname, contactno string, configid int) (int, error)
 	UpdateStaff(user models.User) error
-	GetUserByAuthname(authname string, configid int) (int, string, string)
-	GetUserByContactNo(contactno string, configid int) (int, string, string)
 	UpdateFCMToken(userid int, token string) error
 	GetTenantUserById(userid int) models.TenantUserInfo
 	CreateUser(user models.User) (int, error)
 	GetUserById(uid int) (models.UserInfo, error)
-	GetUserLogin(field, value string, configid int) (int, string, string, int)
+	GetUserLogin(field, value string, configid int) (int, string, string, int, error)
 	UpdateUserFcmToken(uid int, token string) error
 	GetLocationStatus(locationid int) string
 	DeleteUser(userid int) error
@@ -164,7 +164,6 @@ func (r *userRepository) Login(user models.User) (models.UserInfo, error) {
 	return userInfo, nil
 }
 
-
 func (r *userRepository) FindUserID(authname, contactno string, configid int) (int, error) {
 	var uid int
 	var query string
@@ -187,39 +186,10 @@ func (r *userRepository) FindUserID(authname, contactno string, configid int) (i
 	return uid, nil
 }
 
-
-
 func (r *userRepository) UpdateStaff(user models.User) error {
 	return r.db.Table("app_users").Where("userid = ?", user.Userid).Updates(&user).Error
 }
 
-// A till account is not a Nearle Daily user. The two products share this table
-// and nothing else, so every way into the application excludes roles 7 and 8 in
-// the lookup itself: a cashier is not "refused", they are simply not found.
-//
-// Doing it in the query rather than after it is deliberate. A check bolted on
-// afterwards has to be repeated at each of these call sites and is one edit away
-// from being forgotten at one of them, and that one would be the hole.
-func (r *userRepository) GetUserByAuthname(authname string, configid int) (int, string, string) {
-	var uid int
-	var password, status string
-	query := `SELECT userid, password, status FROM app_users
-	          WHERE authname = ? AND configid = ?
-	            AND COALESCE(roleid, 0) NOT IN (7, 8)`
-	r.db.Raw(query, authname, configid).Row().Scan(&uid, &password, &status)
-	return uid, password, status
-}
-
-func (r *userRepository) GetUserByContactNo(contactno string, configid int) (int, string, string) {
-	var uid int
-	var password, status string
-	query := `SELECT userid, password, status FROM app_users
-	          WHERE contactno = ? AND configid = ?
-	            AND COALESCE(roleid, 0) NOT IN (7, 8)`
-	r.db.Raw(query, contactno, configid).Row().Scan(&uid, &password, &status)
-	return uid, password, status
-}
-
 func (r *userRepository) UpdateFCMToken(userid int, token string) error {
 	query := `UPDATE app_users SET userfcmtoken = ? WHERE userid = ?`
 	return r.db.Exec(query, token, userid).Error
@@ -329,9 +299,40 @@ func (r *userRepository) GetUserById(uid int) (models.UserInfo, error) {
 	return user, nil
 }
 
-func (r *userRepository) GetUserLogin(field, value string, configid int) (int, string, string, int) {
-	var uid, roleid int
-	var password, status string
+// GetUserLogin is the one sign-in lookup, for the app and the console alike.
+//
+// `field` is the column matched — "authname" or "contactno", nothing else is
+// accepted — and it is interpolated, so the whitelist is what keeps this from
+// being an injection point.
+//
+// A till account is not a Nearle Daily user. The two products share this table
+// and nothing else, so the lookup itself excludes roles 7 and 8: a cashier is
+// not "refused", they are simply not found. Doing it in the query rather than
+// after it is deliberate — a check bolted on afterwards has to be repeated at
+// every call site and is one edit away from being forgotten at one of them.
+//
+// Three outcomes, and the caller must tell them apart:
+//
+//   - found:      uid > 0, err == nil
+//   - not found:  uid == 0, err == nil
+//   - failed:     err != nil — the database could not answer at all
+//
+// The third used to be invisible. `Row().Scan`'s error was discarded, so a
+// database that was down, a connection pool that was exhausted or a
+// misconfigured `configid` all came back as uid 0 — which the service then
+// reported as "Invalid Email". On 2026-07-20 the deployment lost its
+// ConfigMaps/Secrets and every user on the platform was told their email was
+// wrong, and nothing in the logs said otherwise.
+func (r *userRepository) GetUserLogin(field, value string, configid int) (int, string, string, int, error) {
+	switch field {
+	case "authname", "contactno":
+	default:
+		return 0, "", "", 0, fmt.Errorf("login: %q is not a sign-in field", field)
+	}
+
+	var uid int
+	var password, status sql.NullString
+	var roleid sql.NullInt64
 
 	query := fmt.Sprintf(`
 		SELECT userid, password, status, roleid
@@ -339,9 +340,16 @@ func (r *userRepository) GetUserLogin(field, value string, configid int) (int, s
 		WHERE %s = ? AND configid = ?
 		  AND COALESCE(roleid, 0) NOT IN (7, 8)`, field)
 
-	r.db.Raw(query, value, configid).Row().Scan(&uid, &password, &status, &roleid)
-
-	return uid, password, status, roleid
+	err := r.db.Raw(query, value, configid).Row().Scan(&uid, &password, &status, &roleid)
+	if errors.Is(err, sql.ErrNoRows) {
+		return 0, "", "", 0, nil
+	}
+	if err != nil {
+		return 0, "", "", 0, err
+	}
+	// Nullable columns scanned through sql.Null* so that a NULL password or
+	// role — both exist on real rows — does not itself read as a failed query.
+	return uid, password.String, status.String, int(roleid.Int64), nil
 }
 
 func (r *userRepository) UpdateUserFcmToken(userid int, fcmToken string) error {
@@ -359,5 +367,3 @@ func (r *userRepository) GetLocationStatus(locationid int) string {
 func (r *userRepository) DeleteUser(userid int) error {
 	return r.db.Table("app_users").Where("userid = ?", userid).Delete(&models.User{}).Error
 }
-
-