clickwrap 0.0.0 → 0.1.0

data/lib/clickwrap/schema_requirements.rb

@@ -0,0 +1,196 @@
+# frozen_string_literal: true
+
+module Clickwrap
+  # Which optional tables this installation needs, and whether it has them.
+  #
+  # Seven of the seventeen tables this gem knows about cannot receive a row
+  # until a matching configuration is turned on, and every one of those is off
+  # by default. `clickwrap:install` therefore emits only the reachable ones, and
+  # each capability comes with its own generator flag.
+  #
+  # That trade has exactly one failure mode: a host turns the capability on and
+  # forgets the migration. It must not be discovered by a NoMethodError inside a
+  # capture at 3am, so it is discovered at boot, reported by the doctor, and
+  # refused at the entry points nothing else covers — always with the exact
+  # command that fixes it.
+  module SchemaRequirements
+    Feature = Data.define(:key, :tables, :flag, :because) do
+      def generator_command = "bin/rails generate clickwrap:install #{flag}"
+
+      def explanation
+        "#{because} That needs #{"the" if tables.length == 1}" \
+          "#{tables.length == 1 ? " #{tables.first} table" : " tables #{tables.join(" and ")}"}, " \
+          "which this database does not have. Add #{tables.length == 1 ? "it" : "them"}:\n\n  " \
+          "#{generator_command}\n  bin/rails db:migrate"
+      end
+    end
+
+    FEATURES = [
+      Feature.new(
+        key: :persisted_presentations,
+        tables: %w[clickwrap_presentations].freeze,
+        flag: "--with-persisted-presentations",
+        because: "A policy declares `persist_presentations_before_submission_for`, so Clickwrap " \
+                 "is expected to keep the presentation it offered before the person submitted."
+      ),
+      Feature.new(
+        key: :request_evidence,
+        tables: %w[clickwrap_request_evidence].freeze,
+        flag: "--with-request-evidence",
+        because: "This installation records request evidence — an IP address, a browser " \
+                 "user-agent, or provider-estimated IP geolocation."
+      ),
+      Feature.new(
+        key: :integrity,
+        tables: %w[clickwrap_chain_heads clickwrap_integrity_attestations].freeze,
+        flag: "--with-integrity",
+        because: "This installation configures event chaining, external anchoring, or " \
+                 "third-party timestamping."
+      ),
+      Feature.new(
+        key: :retention_ops,
+        tables: %w[clickwrap_legal_holds clickwrap_disposition_plans].freeze,
+        flag: "--with-retention-ops",
+        because: "Legal holds and reviewed disposition are the operator tooling for deleting " \
+                 "evidence on schedule and pausing that schedule."
+      ),
+      Feature.new(
+        key: :external_actions,
+        tables: %w[clickwrap_external_actions].freeze,
+        flag: "--with-external-actions",
+        because: "`Clickwrap.authorize_external_action!` commits a pending outbox row in the " \
+                 "same transaction as the evidence that authorizes it."
+      )
+    ].freeze
+
+    FEATURES_BY_KEY = FEATURES.index_by(&:key).freeze
+
+    class << self
+      def feature!(key) = FEATURES_BY_KEY.fetch(key)
+
+      # Features whose tables are absent, among the ones the CONFIGURATION says
+      # this installation uses. Retention operations and external actions are
+      # not configured — they are called — so they are checked at their entry
+      # points instead, through `require!`.
+      #
+      # Empty while migrations are pending, and that is the whole point: `rails
+      # db:migrate` boots the application before it runs the migration that
+      # would satisfy this check, so a boot-time raise here would make the fix
+      # unrunnable. An installation mid-migration is not a misconfigured one.
+      def missing_for_configuration
+        return [] unless schema_is_settled?
+
+        %i[persisted_presentations request_evidence integrity]
+          .map { |key| feature!(key) }
+          .select { |feature| configured?(feature.key) && installed?(feature) == false }
+      end
+
+      # False when migrations are pending, when Clickwrap's own core tables are
+      # not there yet, and when the question cannot be answered at all. Each of
+      # those is an installation part-way through being set up, and the fix for
+      # a missing table is a migration — so refusing to boot before it can run
+      # would make the fix unreachable.
+      def schema_is_settled?
+        return false if table_presence("clickwrap_events") != true
+
+        !pending_migrations?
+      rescue StandardError
+        false
+      end
+
+      # `migration_context.migrations_paths` is relative to the application
+      # root, and nothing guarantees the process is running from there — a rake
+      # task, a test suite, and a console all disagree. Resolving against
+      # `Rails.root` is what makes the answer the same from all three.
+      def pending_migrations?
+        context = ::ActiveRecord::Base.connection_pool.migration_context
+        root = (::Rails.root if defined?(::Rails) && ::Rails.respond_to?(:root))
+
+        paths = Array(context.migrations_paths).map do |path|
+          root && !Pathname.new(path).absolute? ? root.join(path).to_s : path
+        end
+
+        ::ActiveRecord::MigrationContext.new(paths).needs_migration?
+      end
+
+      # "Is it safe to query this capability's tables?" — false only when the
+      # answer is a definite no. An unanswerable question is not a no: code that
+      # skipped work because a connection was not up yet would skip it silently.
+      def available?(key)
+        installed?(feature!(key)) != false
+      end
+
+      # Raised at the entry point of a capability nothing in the configuration
+      # announces. `installed?` returning nil means the question could not be
+      # asked (no database yet), and an unanswerable question is not a refusal.
+      def require!(key)
+        feature = feature!(key)
+        return if installed?(feature) != false
+
+        raise ConfigurationError, feature.explanation
+      end
+
+      # true, false, or nil when there is no database to ask. Memoized per
+      # feature and cleared with the rest of the global state, because asking
+      # the connection on every capture would be a query per event.
+      def installed?(feature)
+        cache = (@installed ||= {})
+        return cache[feature.key] if cache.key?(feature.key)
+
+        answers = feature.tables.map { |table| table_presence(table) }
+        # One unanswerable table makes the whole answer unknown. Folding nil
+        # into false here would report "not installed" for every application
+        # whose connection was not up yet, which is most of them at boot.
+        cache[feature.key] = answers.any?(&:nil?) ? nil : answers.all?
+      rescue StandardError
+        cache[feature.key] = nil
+      end
+
+      def reset!
+        @installed = nil
+      end
+
+      private
+
+      # Three answers, not two: true, false, and nil for "there is no live
+      # connection to ask". Deliberately not a predicate, because a predicate
+      # that can answer nil is a predicate somebody will read as false.
+      def table_presence(table)
+        connection = ::ActiveRecord::Base.connection
+        return nil unless connection.active?
+
+        connection.data_source_exists?(table)
+      end
+
+      def configured?(key)
+        case key
+        when :persisted_presentations then any_policy_persists_presentations?
+        when :request_evidence then records_request_evidence?
+        when :integrity then configures_integrity?
+        else false
+        end
+      end
+
+      def any_policy_persists_presentations?
+        Clickwrap.policies.any? { |policy| policy.persist_presentations_for.present? }
+      end
+
+      def records_request_evidence?
+        config = Clickwrap.config
+        return true if config.record_ip_address_by_default || config.record_browser_user_agent_by_default
+        return true if Vocabulary::IP_GEOLOCATION_DATA_FIELDS.any? do |field|
+          config.public_send(:"record_ip_geolocation_#{field}_by_default")
+        end
+
+        Clickwrap.policies.any? { |policy| policy.request_evidence.records_anything? }
+      end
+
+      def configures_integrity?
+        config = Clickwrap.config
+
+        [config.chain_event_history_with, config.anchor_event_history_with,
+         config.timestamp_receipts_with].any?(&:present?)
+      end
+    end
+  end
+end

data/lib/clickwrap/services/authorize_external_action.rb

@@ -0,0 +1,149 @@
+# frozen_string_literal: true
+
+module Clickwrap
+  module Services
+    # `Clickwrap.authorize_external_action!` — the outbox.
+    #
+    # ===========================================================================
+    # READ THIS BEFORE CHANGING ANYTHING HERE.
+    #
+    # This is a DISTRIBUTED RELIABILITY PROTOCOL. It is NOT a cross-system ACID
+    # transaction, and no amount of care in this file could make it one.
+    #
+    # Stripe, an identity service, a timestamp authority, a remote signature
+    # provider: none of them can enlist in your database transaction. There is
+    # no two-phase commit here, no compensating rollback that reaches into
+    # someone else's ledger, and no moment at which "the evidence committed" and
+    # "the provider acted" are known to be true together. Clickwrap never claims
+    # atomicity across two independent systems, and the receipt this produces
+    # does not claim it either.
+    #
+    # What this protocol actually gives you is narrower and achievable:
+    #
+    #   1. ONE local transaction commits the evidence event and a `pending`
+    #      outbox row carrying a server-generated idempotency key.
+    #   2. The provider is called OUTSIDE that transaction, by the host, with
+    #      that key — so a retry reaches the provider as the same request rather
+    #      than as a second one.
+    #   3. The outcome is appended back idempotently through
+    #      `record_provider_success_and_consume!`, `record_provider_failure!`,
+    #      or `record_provider_outcome_unknown!`.
+    #   4. `unknown` stays `unknown` until someone or something resolves it.
+    #
+    # Step 4 is the part people delete first and regret longest. A timeout is
+    # not a failure — it is an absence of information. Writing "failed" because
+    # the socket closed is how a second debit happens; writing "succeeded"
+    # because the retry returned 200 is how a fictional one does. The
+    # reconciliation task exists precisely so the ambiguous case can be settled
+    # later with better information than we have at the moment it occurs.
+    # ===========================================================================
+    class AuthorizeExternalAction
+      # The key handed to the provider. It is derived from the committed event
+      # id, which means one evidence event maps to exactly one external action
+      # forever: a retried capture that replays onto the same event reuses this
+      # key rather than minting a second one, and a provider that honors
+      # idempotency keys will therefore not act twice.
+      #
+      # It is server-generated. A client-supplied idempotency key would let a
+      # browser decide whether a second debit is a duplicate — which is exactly
+      # the decision the server exists to make.
+      def self.idempotency_key_for(policy_key:, event_id:)
+        "clickwrap-#{policy_key}-#{event_id}"
+      end
+
+      def initialize(policy:, provider_name: nil,
+                     after_pending_action_is_saved_inside_transaction: nil,
+                     **capture_options)
+        @policy = policy
+        @provider_name = provider_name&.to_s
+        @after_pending_action_is_saved_inside_transaction =
+          after_pending_action_is_saved_inside_transaction
+        @capture_options = capture_options
+
+        return if @after_pending_action_is_saved_inside_transaction.nil? ||
+                  @after_pending_action_is_saved_inside_transaction.respond_to?(:call)
+
+        raise ArgumentError,
+              "after_pending_action_is_saved_inside_transaction must be callable. It receives " \
+              "pending_action: and pending_receipt: as keyword arguments."
+      end
+
+      attr_reader :policy, :provider_name, :capture_options,
+                  :after_pending_action_is_saved_inside_transaction
+
+      # Captures the evidence and commits the pending outbox row in ONE local
+      # transaction, then returns the ExternalAction so the caller can hand its
+      # id and idempotency key to a job.
+      #
+      # The provider call belongs after this method returns, never inside it. A
+      # transaction held open across someone else's network is a transaction
+      # holding locks on evidence rows while waiting for a stranger's DNS.
+      def call
+        SchemaRequirements.require!(:external_actions)
+
+        action = nil
+
+        receipt = Capture.new(
+          policy: policy,
+          **capture_options,
+          consume_one_time_authorizations: false,
+          record_protected_outcome: false
+        ).capture_and! do |pending|
+          action = create_pending_action!(pending)
+        end
+
+        # A replayed capture returns the original receipt without re-running the
+        # block, so the outbox row for that event already exists. Finding it is
+        # the correct answer: the same authorization, with the same key, not a
+        # second one that could produce a second provider call.
+        action ||= ExternalAction.find_by(event_id: receipt.event_id)
+
+        unless action
+          raise ExternalActionError,
+                "The evidence for #{policy.key} committed as event #{receipt.event_id}, but no " \
+                "pending external action was found for it. Do not call the provider: without a " \
+                "committed outbox row there is nothing to resolve the outcome against."
+        end
+
+        action.reload
+      end
+
+      private
+
+      def create_pending_action!(pending)
+        now = Clickwrap.now
+
+        action = ExternalAction.create!(
+          event_id: pending.event_id,
+          policy_key: policy.key,
+          idempotency_key: self.class.idempotency_key_for(
+            policy_key: policy.key, event_id: pending.event_id
+          ),
+          provider_name: provider_name,
+          state: "pending",
+          attempt_count: 0,
+          requested_at: now,
+          created_at: now,
+          updated_at: now
+        )
+
+        # Some hosts need a temporary compatibility projection while they move
+        # an established audit ledger onto Clickwrap. This hook is deliberately
+        # named for its exact boundary: it runs only for the initial write,
+        # after the pending outbox row is saved, inside the SAME LOCAL database
+        # transaction as the event and action. A replay returns the committed
+        # action and never runs it again.
+        #
+        # Network/provider work never belongs here. A callback failure rolls all
+        # three local writes back, leaving no evidence that claims an external
+        # action was authorized when its required domain projection was not.
+        after_pending_action_is_saved_inside_transaction&.call(
+          pending_action: action,
+          pending_receipt: pending
+        )
+
+        action
+      end
+    end
+  end
+end

data/lib/clickwrap/services/load_policies.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+module Clickwrap
+  module Services
+    # Loads the host's document, policy, and retention declarations.
+    #
+    # They live in ordinary Ruby files — `config/clickwrap.rb` and
+    # `config/clickwrap/*.rb` by default — because that makes them reviewable in
+    # a pull request and deployable like the code they are. The engine re-reads
+    # them through `to_prepare`, so a development reload picks up an edit the
+    # same way it picks up a model change.
+    #
+    # Compilation happens here, at boot, and a mistake raises. A policy that
+    # references a document nobody declared, a consent statement with no
+    # withdrawal route, a one-time authorization with no expiry — each of those
+    # is a bug that would otherwise be discovered by the first person who tried
+    # to sign up, and each one gets a sentence explaining what to do about it.
+    class LoadPolicies
+      def initialize(paths: nil, root: nil)
+        @paths = paths || Clickwrap.config.policy_paths
+        @root = root || default_root
+      end
+
+      attr_reader :paths, :root
+
+      def call
+        files = resolve_files
+        return [] if files.empty?
+
+        reset_registries!
+        files.each { |file| load_file(file) }
+        ValidatePolicyReferences.call
+        files
+      end
+
+      def resolve_files
+        return [] if root.nil?
+
+        paths.flat_map { |pattern| Dir[File.join(root, pattern)] }.uniq.sort
+      end
+
+      private
+
+      def default_root
+        defined?(::Rails) && ::Rails.root ? ::Rails.root.to_s : nil
+      end
+
+      # A reload replaces the declarations rather than adding to them, so a
+      # policy deleted from the file really is gone. Persisted evidence is
+      # untouched: an event references the frozen revision it was captured
+      # under, not whatever is in the registry today.
+      def reset_registries!
+        Clickwrap.documents.clear
+        Clickwrap.policies.clear
+        Clickwrap.retention_classes.clear
+      end
+
+      def load_file(file)
+        load file
+      rescue DefinitionError, ConfigurationError => error
+        raise error.class, "#{error.message}\n\n  (while loading #{relative(file)})", error.backtrace
+      end
+
+      def relative(file)
+        root ? file.delete_prefix("#{root}/") : file
+      end
+    end
+  end
+end

data/lib/clickwrap/services/publish_documents.rb

@@ -0,0 +1,251 @@
+# frozen_string_literal: true
+
+module Clickwrap
+  module Services
+    # `bin/rails clickwrap:publish` — reads the declared document bytes once,
+    # digests them, and freezes a database snapshot.
+    #
+    # After this runs, the snapshot is the evidence and the file on disk is only
+    # where it came from. Editing the file changes nothing about what was
+    # already published, which is exactly the property a receipt from three
+    # years ago depends on.
+    #
+    # The task is idempotent: re-publishing identical bytes under the same label
+    # is a no-op. Re-publishing *different* bytes under the same label is
+    # refused, because a version label that can mean two different documents is
+    # not a version label.
+    class PublishDocuments
+      Outcome = Data.define(:definition, :status, :version, :message) do
+        def published? = status == :published
+        def unchanged? = status == :unchanged
+        def planned? = status == :planned
+      end
+
+      def initialize(dry_run: false, definitions: nil)
+        @dry_run = dry_run
+        @definitions = definitions || Clickwrap.documents.values
+      end
+
+      attr_reader :dry_run, :definitions
+
+      def call
+        definitions.map { |definition| publish(definition) }
+      end
+
+      alias plan call
+
+      private
+
+      def publish(definition)
+        bytes = definition.read_bytes
+        digest = Digest.digest(bytes, algorithm: digest_algorithm)
+        existing = find_existing(definition)
+
+        if existing
+          return conflict(definition, existing, digest) unless matches?(existing, digest)
+
+          return Outcome.new(definition: definition, status: :unchanged, version: existing,
+                             message: "Already published with identical bytes.")
+        end
+
+        if dry_run
+          return Outcome.new(definition: definition, status: :planned, version: nil,
+                             message: "Would publish #{bytes.bytesize} bytes (#{digest}).")
+        end
+
+        Outcome.new(definition: definition, status: :published,
+                    version: create_version(definition, bytes, digest),
+                    message: "Published #{bytes.bytesize} bytes (#{digest}).")
+      end
+
+      def find_existing(definition)
+        document = ::Clickwrap::Document.find_by(
+          document_key: definition.key, tenant_key: definition.tenant_key
+        )
+        return nil unless document
+
+        document.versions.find_by(version_label: definition.version_label, locale: definition.locale)
+      end
+
+      def matches?(existing, digest)
+        Digest.secure_compare?(existing.content_digest, digest)
+      end
+
+      # The refusal a version label exists to make possible.
+      def conflict(definition, existing, digest)
+        raise DocumentVersionConflictError,
+              "Document #{definition} was already published with different bytes.\n  " \
+              "published: #{existing.content_digest}\n  " \
+              "on disk:   #{digest}\n\n" \
+              "Reusing a version label for different content would silently change what every " \
+              "receipt that cites this version says the server offered. Publish the new text " \
+              "under a new version label instead."
+      end
+
+      def create_version(definition, bytes, digest)
+        rendered = render(definition, bytes)
+        backend = storage_backend_for(definition)
+
+        # Active Storage uploads may perform object-store network I/O. Finish
+        # that work before opening the evidence transaction; otherwise a slow
+        # S3 request holds database locks for its entire duration. If the
+        # subsequent database write fails, purge the just-created blob so a
+        # failed publication does not quietly accumulate unattached evidence
+        # objects.
+        uploaded_blob = backend == "active_storage" ? store_in_active_storage(definition, bytes) : nil
+
+        ::ActiveRecord::Base.transaction do
+          document = ::Clickwrap::Document.find_or_create_by!(
+            document_key: definition.key, tenant_key: definition.tenant_key
+          ) { |record| record.created_at = Clickwrap.now }
+
+          document.versions.create!(
+            version_label: definition.version_label,
+            locale: definition.locale,
+            media_type: definition.media_type,
+            content: backend == "database" ? text_for_database(definition, bytes) : nil,
+            storage_locator: uploaded_blob&.signed_id,
+            content_byte_size: bytes.bytesize,
+            content_digest_algorithm: digest_algorithm,
+            content_digest: digest,
+            rendered_content: rendered&.fetch(:bytes, nil),
+            rendered_media_type: rendered&.fetch(:media_type, nil),
+            rendered_content_digest: rendered && Digest.digest(rendered[:bytes], algorithm: digest_algorithm),
+            renderer_name: rendered&.fetch(:renderer_name, nil),
+            renderer_version: rendered&.fetch(:renderer_version, nil),
+            sanitizer_name: rendered&.fetch(:sanitizer_name, nil),
+            sanitizer_version: rendered&.fetch(:sanitizer_version, nil),
+            storage_backend: backend,
+            source_reference: definition.source_reference,
+            # A version with no declared schedule is effective as soon as it is
+            # published. Storing that explicitly rather than leaving NULL keeps
+            # "which version is current" a deterministic question: PostgreSQL
+            # sorts NULLs first in a descending order and SQLite sorts them
+            # last, so a nullable column here would mean two databases
+            # disagreeing about which document the server offered.
+            effective_at: definition.effective_at || Clickwrap.now,
+            published_at: Clickwrap.now,
+            created_at: Clickwrap.now
+          )
+        end
+      rescue StandardError => error
+        purge_failed_upload(uploaded_blob, original_error: error)
+        raise
+      end
+
+      # When a source format is transformed for display, the rendered bytes are
+      # stored and digested alongside the source. That keeps "this Markdown file
+      # existed" and "this rendered representation was offered" as two separate
+      # claims instead of letting one borrow the other's credibility.
+      #
+      # A custom renderer must return the exact bytes it offered. It is given
+      # no opportunity to render one thing and report another.
+      def render(definition, bytes)
+        renderer = definition.renderer || Clickwrap.config.document_renderer
+        return nil unless renderer
+
+        result = renderer.call(bytes, definition)
+        return nil if result.nil?
+
+        result = { bytes: result } if result.is_a?(String)
+        result = result.symbolize_keys
+
+        unless result[:bytes].is_a?(String)
+          raise ConfigurationError,
+                "A document renderer must return the exact rendered bytes as a String (or a Hash " \
+                "with a :bytes key). It returned #{result[:bytes].class}."
+        end
+
+        # The safety net for renderers that made NO sanitation decision: a bare
+        # String or a Hash without sanitizer provenance gets the safe list. A
+        # renderer that DECLARED its decision — including the deliberate
+        # "none" of a byte-parity host renderer — owns it; re-sanitizing here
+        # would reparse the bytes and silently overwrite the provenance,
+        # making the stored record claim a different pipeline than the one
+        # that ran.
+        if result.fetch(:media_type, "").to_s.start_with?("text/html") &&
+           result[:sanitizer_name].to_s.empty?
+          result[:bytes] = DocumentRenderer.sanitize_html(result[:bytes])
+          result[:sanitizer_name] = DocumentRenderer::SANITIZER_NAME
+          result[:sanitizer_version] = DocumentRenderer::SANITIZER_VERSION
+        end
+
+        result
+      end
+
+      # Documents are read as binary, because the digest has to cover the exact
+      # bytes on disk and nothing about them may be normalized on the way in.
+      # A text column, though, holds text — so the bytes are tagged UTF-8 here,
+      # and a document that is not valid UTF-8 is refused rather than mangled.
+      #
+      # An em dash is enough to hit this: the bytes come back as ASCII-8BIT and
+      # a database that is told to store them as text will either raise or
+      # quietly corrupt them, and a corrupted document is one whose digest will
+      # never verify again.
+      def text_for_database(definition, bytes)
+        text = bytes.dup.force_encoding(Encoding::UTF_8)
+        return text if text.valid_encoding?
+
+        raise DefinitionError,
+              "Document #{definition} is not valid UTF-8, so it cannot be stored in a text " \
+              "column. Binary documents — a PDF, a scan, an image — need a storage backend " \
+              "that keeps bytes as bytes: set `config.store_document_contents_in = " \
+              ":active_storage`, or supply a resolver that returns them."
+      end
+
+      # Where the bytes come FROM and where they are KEPT are different
+      # questions, and a per-document `resolver:` answers the first one only —
+      # exactly like `from:` and `content:`. Publishing calls it once, and from
+      # then on the frozen snapshot is the evidence.
+      #
+      # `config.store_document_contents_in = :resolver` is the other question:
+      # it says the application will hand back the bytes on every read rather
+      # than have Clickwrap keep them. That adapter still has to return
+      # immutable bytes that hash to the recorded digest, which is verified on
+      # every read.
+      def storage_backend_for(_definition)
+        Clickwrap.config.store_document_contents_in.to_s
+      end
+
+      # Larger applications can keep document bodies in content-addressed object
+      # storage instead of the database. The contract does not change: whatever
+      # the adapter returns must be the exact immutable bytes, and the digest
+      # recorded here is verified against them on every read. A locator alone is
+      # never a document version.
+      def store_in_active_storage(definition, bytes)
+        unless defined?(::ActiveStorage)
+          raise ConfigurationError,
+                "store_document_contents_in is :active_storage, but Active Storage is not loaded " \
+                "in this application. Clickwrap does not depend on it; require it, or use " \
+                ":database."
+        end
+
+        ::ActiveStorage::Blob.create_and_upload!(
+          io: StringIO.new(bytes),
+          filename: "#{definition.key}-#{definition.version_label}-#{definition.locale}",
+          content_type: definition.media_type,
+          identify: false
+        )
+      end
+
+      def purge_failed_upload(blob, original_error:)
+        return if blob.nil?
+
+        blob.purge
+      rescue StandardError => error
+        if defined?(::Rails) && ::Rails.respond_to?(:error)
+          ::Rails.error.report(
+            error,
+            handled: true,
+            context: {
+              clickwrap_operation: "purge_failed_document_upload",
+              original_error_class: original_error.class.name
+            }
+          )
+        end
+      end
+
+      def digest_algorithm = Clickwrap.config.digest_canonical_receipts_with.to_s
+    end
+  end
+end