command_tower 0.10.0 → 0.11.0

data/lib/command_tower/impersonation/clear_overlay_for_audit.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Impersonation
+    # Temporarily clear overlay identity so impersonation_ended audits attribute
+    # as admin_direct to the actor. Lives outside workflows/services so leaf
+    # layers do not establish Current execution boundaries themselves.
+    module ClearOverlayForAudit
+      module_function
+
+      def call(actor_user_id:)
+        CommandTower::Current.set(
+          user_id: actor_user_id,
+          effective_user_id: actor_user_id,
+          originating_administrator_id: nil,
+          impersonation_active: false
+        ) do
+          yield
+        end
+      end
+    end
+  end
+end

data/lib/command_tower/impersonation/establish_identity.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Impersonation
+    EstablishedIdentity = Data.define(:user, :actor, :session, :status) do
+      def expired?
+        status == :expired
+      end
+
+      def active?
+        status == :active
+      end
+    end
+
+    module EstablishIdentity
+      module_function
+
+      def call(actor:, impersonation_session_id:, mode: :enforce)
+        overlay = ApplyOverlay.call(actor:, session_id: impersonation_session_id, mode:)
+        if overlay.status == :expired && mode.to_sym == :enforce
+          CommandTower::Execution::IdentityEnrichment.from_user(actor)
+          return EstablishedIdentity.new(user: actor, actor:, session: overlay.session, status: :expired)
+        end
+
+        if overlay.status == :active
+          CommandTower::Execution::IdentityEnrichment.from_impersonation_session(
+            overlay.session,
+            actor: overlay.actor,
+            target: overlay.target
+          )
+          return EstablishedIdentity.new(
+            user: overlay.target,
+            actor: overlay.actor,
+            session: overlay.session,
+            status: :active
+          )
+        end
+
+        CommandTower::Execution::IdentityEnrichment.from_user(actor)
+        EstablishedIdentity.new(user: actor, actor:, session: overlay.session, status: overlay.status)
+      end
+    end
+  end
+end

data/lib/command_tower/install/baseline.rb

@@ -11,6 +11,9 @@ module CommandTower
         20260805000003_create_command_tower_messaging_core.rb
         20260805000004_create_messaging_notification_preferences.rb
         20260805000005_create_messaging_endpoints_and_pushover_credentials.rb
+        20260816000001_create_command_tower_audit_events.rb
+        20260817000001_add_scope_columns_to_command_tower_audit_events.rb
+        20260817000003_create_command_tower_impersonation_sessions.rb
       ].freeze
 
       module_function

data/lib/command_tower/logging/lifecycle_declaration.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Logging
+    module LifecycleDeclaration
+      def self.included(base)
+        base.extend ClassMethods
+      end
+
+      module ClassMethods
+        def log_lifecycle!
+          @lifecycle_loggable = true
+        end
+
+        def disable_lifecycle_logging!
+          @lifecycle_loggable = false
+        end
+
+        def lifecycle_loggable?
+          return @lifecycle_loggable unless @lifecycle_loggable.nil?
+
+          superclass.respond_to?(:lifecycle_loggable?) ? superclass.lifecycle_loggable? : false
+        end
+      end
+    end
+  end
+end

data/lib/command_tower/logging/projection.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Logging
+    module Projection
+      DROP = %i[event_uuid layer log_lifecycle log_level].freeze
+
+      module_function
+
+      def call(event)
+        payload = symbolize(event.payload)
+        projected = { event: event.name }
+
+        copy_if_present(projected, payload, :subject)
+        copy_if_present(projected, payload, :execution_uuid)
+        copy_if_present(projected, payload, :correlation_id)
+        copy_if_present(projected, payload, :outcome)
+        copy_if_present(projected, payload, :duration_ms)
+        copy_if_present(projected, payload, :user_id)
+        copy_if_present(projected, payload, :error_class)
+        copy_if_present(projected, payload, :error_codes)
+        copy_if_present(projected, payload, :causation_id)
+        copy_if_present(projected, payload, :originating_administrator_id)
+
+        request_id = payload[:request_id]
+        if !request_id.nil? && request_id != payload[:correlation_id]
+          projected[:request_id] = request_id
+        end
+
+        source = payload[:source]
+        projected[:source] = source if !source.nil? && source.to_s != "http"
+
+        effective = payload[:effective_user_id]
+        projected[:effective_user_id] = effective if !effective.nil? && effective != payload[:user_id]
+
+        projected[:impersonation_active] = true if payload[:impersonation_active] == true
+
+        payload.each do |key, value|
+          next if DROP.include?(key)
+          next if projected.key?(key)
+          next if value.nil?
+          next if key == :impersonation_active
+          next if key == :source
+          next if key == :request_id
+          next if key == :effective_user_id
+
+          projected[key] = value
+        end
+
+        projected
+      end
+
+      def symbolize(payload)
+        hash = payload.respond_to?(:to_h) ? payload.to_h : {}
+        hash.each_with_object({}) do |(key, value), memo|
+          memo[key.to_sym] = value
+        end
+      end
+
+      def copy_if_present(projected, payload, key)
+        value = payload[key]
+        projected[key] = value unless value.nil?
+      end
+      private_class_method :symbolize, :copy_if_present
+    end
+  end
+end

data/lib/command_tower/logging/subscriber.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Logging
+    class Subscriber < ActiveSupport::LogSubscriber
+      PATTERNS = [
+        /\Acommand_tower\.lifecycle(?:\.|\z)/,
+        /\Acommand_tower\.log(?:\.|\z)/,
+        /\Acommand_tower\.messaging(?:\.|\z)/
+      ].freeze
+      SEVERITIES = %i[debug info warn error].freeze
+
+      class << self
+        def logger
+          @logger || super
+        end
+
+        def logger=(value)
+          @logger = value
+        end
+
+        def attach!
+          detach!
+          subscriber = new
+          @subscriptions = PATTERNS.map do |pattern|
+            ActiveSupport::Notifications.subscribe(pattern) do |name, started, finished, id, payload|
+              event = ActiveSupport::Notifications::Event.new(name, started, finished, id, payload)
+              subscriber.call(event)
+            end
+          end
+        end
+
+        def detach!
+          Array(@subscriptions).each { |subscription| ActiveSupport::Notifications.unsubscribe(subscription) }
+          @subscriptions = []
+        end
+
+        def subscriptions
+          Array(@subscriptions)
+        end
+      end
+
+      def call(event)
+        return if logger.nil?
+        return unless materialize?(event)
+
+        severity = severity_for(event)
+        logger.public_send(severity, log_entry(event))
+      rescue StandardError
+        begin
+          logger&.error({ event: "command_tower.logging.subscriber_failed", error_class: $!.class.name })
+        rescue StandardError
+          nil
+        end
+      end
+
+      def logger
+        self.class.logger
+      end
+
+      private
+
+      def materialize?(event)
+        name = event.name
+        return true if name.start_with?("command_tower.log.")
+        return true if name.start_with?("command_tower.messaging.")
+        return false unless name.start_with?("command_tower.lifecycle.")
+        return false if name.end_with?(".started")
+
+        outcome = (event.payload[:outcome] || event.payload["outcome"]).to_s
+        return true if %w[failure error].include?(outcome)
+
+        event.payload[:log_lifecycle] == true || event.payload["log_lifecycle"] == true
+      end
+
+      def log_entry(event)
+        CommandTower::Logging::Projection.call(event)
+      end
+
+      def severity_for(event)
+        name = event.name
+        if name.start_with?("command_tower.log.")
+          return named_severity(name.split(".").last)
+        end
+
+        payload_level = event.payload[:log_level] || event.payload["log_level"]
+        return named_severity(payload_level) if payload_level
+
+        return :debug if name.end_with?(".started")
+
+        outcome = event.payload[:outcome] || event.payload["outcome"]
+        return :error if outcome.to_s == "error"
+
+        :info
+      end
+
+      def named_severity(value)
+        level = value.to_sym
+        SEVERITIES.include?(level) ? level : :info
+      end
+    end
+  end
+end

data/lib/command_tower/principal_capabilities.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module PrincipalCapabilities
+    class Error < CommandTower::Error; end
+
+    class UnregisteredCapabilityError < Error; end
+    class DuplicateCapabilityError < Error; end
+    class HostOverrideError < Error; end
+    class InvalidCapabilityNameError < Error; end
+    class InvalidCapabilityDefinitionError < Error; end
+    class MissingRequiredEntityError < Error; end
+    class FrozenRegistryError < Error; end
+  end
+end

data/lib/command_tower/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module CommandTower
-  VERSION = "0.10.0"
+  VERSION = "0.11.0"
 end

data/lib/command_tower.rb

@@ -1,5 +1,17 @@
 require "command_tower/error"
 require "command_tower/current"
+require "command_tower/execution"
+require "command_tower/events"
+require "command_tower/audit"
+require "command_tower/impersonation/activity_declaration"
+require "command_tower/impersonation/apply_overlay"
+require "command_tower/impersonation/clear_overlay_for_audit"
+require "command_tower/impersonation/establish_identity"
+require "command_tower/admin_workspace"
+require "command_tower/admin_scope"
+require "command_tower/logging/lifecycle_declaration"
+require "command_tower/logging/projection"
+require "command_tower/logging/subscriber"
 
 require "command_tower/version"
 require "command_tower/engine"

data/spec/factories/impersonation_session.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :impersonation_session, class: "CommandTower::Impersonation::Session" do
+    association :actor, factory: :user
+    association :target, factory: :user
+    started_at { Time.current }
+    last_activity_at { Time.current }
+    idle_expires_at { 10.minutes.from_now }
+    absolute_expires_at { 1.hour.from_now }
+
+    trait :ended do
+      ended_at { Time.current }
+      end_reason { "manual" }
+    end
+  end
+end

data/spec/factories/user.rb

@@ -40,6 +40,22 @@ FactoryBot.define do
       roles { ["owner"] }
     end
 
+    trait :role_impersonation_operator do
+      roles { ["impersonation_operator"] }
+    end
+
+    trait :role_rbac_admin do
+      roles { ["rbac_admin"] }
+    end
+
+    trait :role_support_admin do
+      roles { ["support_admin"] }
+    end
+
+    trait :role_users_identity_admin do
+      roles { ["users_identity_admin"] }
+    end
+
     trait :without_phone do
       phone_number { nil }
       phone_number_validated { false }