command_tower 0.10.0 → 0.11.0

data/app/deserializers/command_tower/deserializers/admin/scope_parameter.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Deserializers
+    module Admin
+      module ScopeParameter
+        module_function
+
+        def extract(params, tool_id:)
+          definition = CommandTower.config.registry.admin_workspace.fetch(tool_id)
+          return nil unless definition.scope_required?
+
+          keys = parameter_keys(definition.scope_parameter)
+          raw = fetch_raw(params, keys)
+          return nil if raw.nil? || raw.to_s.strip.empty?
+
+          raw.to_s.strip
+        end
+
+        def fetch_raw(params, keys)
+          hash =
+            if params.respond_to?(:to_unsafe_h)
+              params.to_unsafe_h
+            elsif params.respond_to?(:to_h)
+              params.to_h
+            else
+              params
+            end
+
+          keys.each do |key|
+            string_key = key.to_s
+            symbol_key = key.to_sym
+            return hash[string_key] if hash.key?(string_key)
+            return hash[symbol_key] if hash.key?(symbol_key)
+          end
+          nil
+        end
+        private_class_method :fetch_raw
+
+        def parameter_keys(parameter)
+          snake = parameter.to_s
+          camel = snake.camelize(:lower)
+          [snake.to_sym, snake, camel.to_sym, camel]
+        end
+        private_class_method :parameter_keys
+      end
+    end
+  end
+end

data/app/deserializers/command_tower/deserializers/admin/users.rb

@@ -0,0 +1,218 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Deserializers
+    module Admin
+      module Users
+        module IdentityId
+          module_function
+
+          def coerce(raw)
+            return raw if raw.is_a?(Integer) && raw.positive?
+            return if raw.nil?
+
+            text = raw.to_s.strip
+            return if text.empty? || !/\A\d+\z/.match?(text)
+
+            Integer(text, 10).then { |value| value.positive? ? value : nil }
+          rescue ArgumentError
+            nil
+          end
+        end
+
+        class ListDeserializer < CommandTower::Deserializers::ApplicationDeserializer
+          Input = Data.define(:limit, :offset, :search, :scope_value)
+          DEFAULT_LIMIT = 50
+          MAX_LIMIT = 100
+          MAX_SEARCH_LENGTH = 100
+          TOOL_ID = "users"
+
+          def call(params)
+            limit = pagination_integer(
+              fetch_param(params, :limit).value,
+              default: DEFAULT_LIMIT,
+              minimum: 1,
+              maximum: MAX_LIMIT
+            )
+            return failure(errors: { message: "invalid_limit" }) if limit.nil?
+
+            offset = pagination_integer(fetch_param(params, :offset).value, default: 0, minimum: 0)
+            return failure(errors: { message: "invalid_offset" }) if offset.nil?
+
+            search = optional_search(fetch_param(params, :search).value)
+            return search if deserializer_result?(search)
+
+            scope_value = CommandTower::Deserializers::Admin::ScopeParameter.extract(params, tool_id: TOOL_ID)
+
+            success(Input.new(limit:, offset:, search:, scope_value:))
+          end
+
+          private
+
+          def pagination_integer(raw, default:, minimum:, maximum: nil)
+            return default if raw.nil? || (raw.is_a?(String) && raw.strip.empty?)
+
+            value = raw.is_a?(Integer) ? raw : (Integer(raw, 10) if raw.is_a?(String) && /\A-?\d+\z/.match?(raw.strip))
+            return if value.nil? || value < minimum || (maximum && value > maximum)
+
+            value
+          rescue ArgumentError
+            nil
+          end
+
+          # Returns nil, a trimmed String, or a DeserializerResult failure.
+          def optional_search(raw)
+            return nil if raw.nil?
+
+            text = raw.to_s.strip
+            return nil if text.empty?
+            return failure(errors: { message: "invalid_search" }) if text.length > MAX_SEARCH_LENGTH
+
+            text
+          end
+        end
+
+        class ShowDeserializer < CommandTower::Deserializers::ApplicationDeserializer
+          Input = Data.define(:id, :scope_value)
+          TOOL_ID = "users"
+
+          def call(params)
+            id = IdentityId.coerce(fetch_param(params, :id).value)
+            return failure(errors: { message: "invalid_id" }) if id.nil?
+
+            scope_value = CommandTower::Deserializers::Admin::ScopeParameter.extract(params, tool_id: TOOL_ID)
+
+            success(Input.new(id:, scope_value:))
+          end
+        end
+
+        class UpdateNameDeserializer < CommandTower::Deserializers::ApplicationDeserializer
+          Input = Data.define(:id, :first_name, :last_name, :scope_value)
+
+          def call(params)
+            id = IdentityId.coerce(fetch_param(params, :id).value)
+            return failure(errors: { message: "invalid_id" }) if id.nil?
+
+            first_name = fetch_param(params, :first_name, :firstName).value.to_s.strip
+            last_name = fetch_param(params, :last_name, :lastName).value.to_s.strip
+            if first_name.blank? || last_name.blank?
+              return failure(errors: { message: "missing_required_fields" })
+            end
+
+            success(
+              Input.new(
+                id:,
+                first_name:,
+                last_name:,
+                scope_value: CommandTower::Deserializers::Admin::ScopeParameter.extract(params, tool_id: ShowDeserializer::TOOL_ID)
+              )
+            )
+          end
+        end
+
+        class UpdateUsernameDeserializer < CommandTower::Deserializers::ApplicationDeserializer
+          Input = Data.define(:id, :username, :scope_value)
+
+          def call(params)
+            id = IdentityId.coerce(fetch_param(params, :id).value)
+            return failure(errors: { message: "invalid_id" }) if id.nil?
+
+            username = fetch_param(params, :username).value.to_s.strip
+            return failure(errors: { message: "missing_required_fields" }) if username.blank?
+
+            success(
+              Input.new(
+                id:,
+                username:,
+                scope_value: CommandTower::Deserializers::Admin::ScopeParameter.extract(params, tool_id: ShowDeserializer::TOOL_ID)
+              )
+            )
+          end
+        end
+
+        class UpdateEmailDeserializer < CommandTower::Deserializers::ApplicationDeserializer
+          Input = Data.define(:id, :email, :scope_value)
+
+          def call(params)
+            id = IdentityId.coerce(fetch_param(params, :id).value)
+            return failure(errors: { message: "invalid_id" }) if id.nil?
+
+            email = fetch_param(params, :email).value.to_s.strip
+            return failure(errors: { message: "missing_required_fields" }) if email.blank?
+
+            success(
+              Input.new(
+                id:,
+                email:,
+                scope_value: CommandTower::Deserializers::Admin::ScopeParameter.extract(params, tool_id: ShowDeserializer::TOOL_ID)
+              )
+            )
+          end
+        end
+
+        class UpdateEmailValidationDeserializer < CommandTower::Deserializers::ApplicationDeserializer
+          Input = Data.define(:id, :email_validated, :scope_value)
+
+          def call(params)
+            id = IdentityId.coerce(fetch_param(params, :id).value)
+            return failure(errors: { message: "invalid_id" }) if id.nil?
+
+            email_validated = coerce_boolean(fetch_param(params, :emailValidated, :email_validated).value)
+            return failure(errors: { message: "invalid_email_validated" }) if email_validated.nil?
+
+            success(
+              Input.new(
+                id:,
+                email_validated:,
+                scope_value: CommandTower::Deserializers::Admin::ScopeParameter.extract(params, tool_id: ShowDeserializer::TOOL_ID)
+              )
+            )
+          end
+
+          private
+
+          def coerce_boolean(raw)
+            case raw
+            when true, false
+              raw
+            when "true", "1", 1
+              true
+            when "false", "0", 0
+              false
+            end
+          end
+        end
+
+        class UpdateRolesDeserializer < CommandTower::Deserializers::ApplicationDeserializer
+          Input = Data.define(:id, :roles, :scope_value)
+
+          def call(params)
+            id = IdentityId.coerce(fetch_param(params, :id).value)
+            return failure(errors: { message: "invalid_id" }) if id.nil?
+
+            raw = fetch_param(params, :roles).value
+            unless raw.is_a?(Array)
+              return failure(errors: { message: "invalid_roles" })
+            end
+
+            roles = raw.map { |value| value.to_s.strip }
+            if roles.any?(&:blank?)
+              return failure(errors: { message: "invalid_roles" })
+            end
+
+            success(
+              Input.new(
+                id:,
+                roles:,
+                scope_value: CommandTower::Deserializers::Admin::ScopeParameter.extract(
+                  params,
+                  tool_id: ShowDeserializer::TOOL_ID
+                )
+              )
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/deserializers/command_tower/deserializers/audit/events.rb

@@ -0,0 +1,224 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Deserializers
+    module Audit
+      module Events
+        class UserListDeserializer < CommandTower::Deserializers::ApplicationDeserializer
+          Input = Data.define(:limit, :offset, :actions, :occurred_after, :occurred_before, :subject_types)
+          DEFAULT_LIMIT = 50
+          MAX_LIMIT = 100
+          MAX_MULTI = 50
+          EVENT_NAME = /\A[a-z][a-z0-9_]*\z/
+          SUBJECT_TYPE = /\A[A-Z][A-Za-z0-9_:]*\z/
+
+          def call(params)
+            limit = pagination_integer(fetch_param(params, :limit).value, default: DEFAULT_LIMIT, minimum: 1, maximum: MAX_LIMIT)
+            return failure(errors: { message: "invalid_limit" }) if limit.nil?
+
+            offset = pagination_integer(fetch_param(params, :offset).value, default: 0, minimum: 0)
+            return failure(errors: { message: "invalid_offset" }) if offset.nil?
+
+            actions = optional_event_names(params)
+            return actions if deserializer_result?(actions)
+
+            occurred_after = optional_time(fetch_param(params, :occurredAfter, :occurred_after).value, field: "occurredAfter")
+            return occurred_after if deserializer_result?(occurred_after)
+
+            occurred_before = optional_time(fetch_param(params, :occurredBefore, :occurred_before).value, field: "occurredBefore")
+            return occurred_before if deserializer_result?(occurred_before)
+
+            subject_types = optional_subject_types(params)
+            return subject_types if deserializer_result?(subject_types)
+
+            success(Input.new(limit:, offset:, actions:, occurred_after:, occurred_before:, subject_types:))
+          end
+
+          private
+
+          def pagination_integer(raw, default:, minimum:, maximum: nil)
+            return default if raw.nil? || (raw.is_a?(String) && raw.strip.empty?)
+
+            value = raw.is_a?(Integer) ? raw : (Integer(raw, 10) if raw.is_a?(String) && /\A-?\d+\z/.match?(raw.strip))
+            return if value.nil? || value < minimum || (maximum && value > maximum)
+
+            value
+          rescue ArgumentError
+            nil
+          end
+
+          # Prefer eventNames[] / event_names[]; singular eventName remains a one-element alias.
+          def optional_event_names(params)
+            multi = fetch_param(params, :eventNames, :event_names).value
+            singular = fetch_param(params, :eventName, :event_name).value
+            normalize_token_list(
+              multi,
+              singular,
+              regex: EVENT_NAME,
+              invalid_message: "invalid_eventName",
+              too_many_message: "invalid_eventNames"
+            )
+          end
+
+          def optional_subject_types(params)
+            multi = fetch_param(params, :subjectTypes, :subject_types).value
+            singular = fetch_param(params, :subjectType, :subject_type).value
+            normalize_token_list(
+              multi,
+              singular,
+              regex: SUBJECT_TYPE,
+              invalid_message: "invalid_subjectType",
+              too_many_message: "invalid_subjectTypes"
+            )
+          end
+
+          def normalize_token_list(multi, singular, regex:, invalid_message:, too_many_message:)
+            raw_values =
+              if multi.nil? || (multi.is_a?(String) && multi.strip.empty?)
+                singular.nil? || (singular.is_a?(String) && singular.strip.empty?) ? [] : [singular]
+              elsif multi.is_a?(Array)
+                multi
+              elsif multi.is_a?(String)
+                [multi]
+              else
+                return failure(errors: { message: too_many_message })
+              end
+
+            tokens = []
+            raw_values.each do |raw|
+              next if raw.nil? || (raw.is_a?(String) && raw.strip.empty?)
+              return failure(errors: { message: invalid_message }) unless raw.is_a?(String) && regex.match?(raw.strip)
+
+              tokens << raw.strip
+            end
+
+            tokens = tokens.uniq
+            return failure(errors: { message: too_many_message }) if tokens.length > MAX_MULTI
+
+            tokens
+          end
+
+          def optional_time(raw, field:)
+            return if raw.nil? || (raw.is_a?(String) && raw.strip.empty?)
+            return failure(errors: { message: "invalid_#{field}" }) unless raw.is_a?(String)
+
+            Time.iso8601(raw.strip)
+          rescue ArgumentError
+            failure(errors: { message: "invalid_#{field}" })
+          end
+
+          def optional_positive_integer(raw, field:)
+            return if raw.nil? || (raw.is_a?(String) && raw.strip.empty?)
+
+            value = raw.is_a?(Integer) ? raw : (Integer(raw, 10) if raw.is_a?(String) && /\A\d+\z/.match?(raw.strip))
+            return failure(errors: { message: "invalid_#{field}" }) unless value&.positive?
+
+            value
+          rescue ArgumentError
+            failure(errors: { message: "invalid_#{field}" })
+          end
+        end
+
+        class AdminListDeserializer < UserListDeserializer
+          Input = Data.define(
+            :limit,
+            :offset,
+            :actions,
+            :occurred_after,
+            :occurred_before,
+            :subject_types,
+            :affected_user_id,
+            :actor_user_id,
+            :originating_administrator_id,
+            :attribution_mode,
+            :scope_value
+          )
+          TOOL_ID = "audit"
+
+          def call(params)
+            base = super
+            return base unless base.success?
+
+            affected_user_id = optional_positive_integer(
+              fetch_param(params, :affectedUserId, :affected_user_id).value,
+              field: "affectedUserId"
+            )
+            return affected_user_id if deserializer_result?(affected_user_id)
+
+            actor_user_id = optional_positive_integer(
+              fetch_param(params, :actorUserId, :actor_user_id).value,
+              field: "actorUserId"
+            )
+            return actor_user_id if deserializer_result?(actor_user_id)
+
+            originating_administrator_id = optional_positive_integer(
+              fetch_param(params, :originatingAdministratorId, :originating_administrator_id).value,
+              field: "originatingAdministratorId"
+            )
+            return originating_administrator_id if deserializer_result?(originating_administrator_id)
+
+            attribution_mode = optional_attribution_mode(fetch_param(params, :attributionMode, :attribution_mode).value)
+            return attribution_mode if deserializer_result?(attribution_mode)
+
+            scope_value = CommandTower::Deserializers::Admin::ScopeParameter.extract(params, tool_id: TOOL_ID)
+
+            success(
+              Input.new(
+                limit: base.input.limit,
+                offset: base.input.offset,
+                actions: base.input.actions,
+                occurred_after: base.input.occurred_after,
+                occurred_before: base.input.occurred_before,
+                subject_types: base.input.subject_types,
+                affected_user_id:,
+                actor_user_id:,
+                originating_administrator_id:,
+                attribution_mode:,
+                scope_value:
+              )
+            )
+          end
+
+          private
+
+          def optional_attribution_mode(raw)
+            return if raw.nil? || (raw.is_a?(String) && raw.strip.empty?)
+            unless raw.is_a?(String) && CommandTower::Audit::Event::ATTRIBUTION_MODES.include?(raw.strip)
+              return failure(errors: { message: "invalid_attributionMode" })
+            end
+
+            raw.strip
+          end
+        end
+
+        class ShowDeserializer < CommandTower::Deserializers::ApplicationDeserializer
+          Input = Data.define(:id, :scope_value)
+          TOOL_ID = "audit"
+
+          def call(params)
+            id = optional_positive_integer(fetch_param(params, :id).value, field: "id")
+            return id if deserializer_result?(id)
+            return failure(errors: { message: "invalid_id" }) if id.nil?
+
+            scope_value = CommandTower::Deserializers::Admin::ScopeParameter.extract(params, tool_id: TOOL_ID)
+
+            success(Input.new(id:, scope_value:))
+          end
+
+          private
+
+          def optional_positive_integer(raw, field:)
+            return if raw.nil? || (raw.is_a?(String) && raw.strip.empty?)
+
+            value = raw.is_a?(Integer) ? raw : (Integer(raw, 10) if raw.is_a?(String) && /\A\d+\z/.match?(raw.strip))
+            return failure(errors: { message: "invalid_#{field}" }) unless value&.positive?
+
+            value
+          rescue ArgumentError
+            failure(errors: { message: "invalid_#{field}" })
+          end
+        end
+      end
+    end
+  end
+end

data/app/deserializers/command_tower/deserializers/clients/types.rb

@@ -22,6 +22,10 @@ module CommandTower
           BooleanType.instance
         end
 
+        def float
+          FloatType.instance
+        end
+
         def array(element_type)
           ArrayType.new(normalize(element_type))
         end
@@ -127,6 +131,29 @@ module CommandTower
           end
         end
 
+        class FloatType < Type
+          include Singleton
+
+          def call(value, path:)
+            return value if value.is_a?(Float)
+            return value.to_f if value.is_a?(Integer)
+
+            if value.is_a?(String)
+              begin
+                return Float(value)
+              rescue ArgumentError
+                reject!(path, value, "float", "not a numeric string")
+              end
+            end
+
+            reject!(path, value, "float", "expected Float")
+          end
+
+          def expected_label
+            "float"
+          end
+        end
+
         class ResultInstanceType < Type
           def initialize(klass)
             @klass = klass

data/app/errors/command_tower/errors/auth/admin_unavailable_during_impersonation_error.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Errors
+    module Auth
+      class AdminUnavailableDuringImpersonationError < CommandTower::Errors::ApplicationError
+        def code
+          "admin_unavailable_during_impersonation"
+        end
+
+        def message
+          "Admin tools are unavailable while impersonating a user."
+        end
+      end
+    end
+  end
+end

data/app/errors/command_tower/errors/auth/default_membership_assignment_error.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Errors
+    module Auth
+      class DefaultMembershipAssignmentError < CommandTower::Errors::ApplicationError
+        def code
+          "default_membership_assignment_failed"
+        end
+
+        def message
+          "Default membership role could not be assigned"
+        end
+      end
+    end
+  end
+end

data/app/errors/command_tower/errors/auth/impersonation_session_expired_error.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Errors
+    module Auth
+      class ImpersonationSessionExpiredError < CommandTower::Errors::UnauthorizedError
+        def code
+          "impersonation_session_expired"
+        end
+
+        def message
+          "Impersonation session is no longer valid"
+        end
+      end
+    end
+  end
+end

data/app/errors/command_tower/errors/auth/impersonation_session_missing_error.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Errors
+    module Auth
+      class ImpersonationSessionMissingError < CommandTower::Errors::ValidationError
+        def initialize
+          super(details: { impersonation: "not_active" })
+        end
+
+        def code
+          "impersonation_session_missing"
+        end
+
+        def message
+          "Impersonation is not active"
+        end
+      end
+    end
+  end
+end

data/app/errors/command_tower/errors/auth/nested_impersonation_error.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Errors
+    module Auth
+      class NestedImpersonationError < CommandTower::Errors::ForbiddenError
+        def code
+          "nested_impersonation_forbidden"
+        end
+
+        def message
+          "Nested impersonation is forbidden"
+        end
+      end
+    end
+  end
+end

data/app/errors/command_tower/errors/auth/self_impersonation_error.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Errors
+    module Auth
+      class SelfImpersonationError < CommandTower::Errors::ValidationError
+        def initialize
+          super(details: { target: "cannot_impersonate_self" })
+        end
+
+        def code
+          "self_impersonation_forbidden"
+        end
+
+        def message
+          "Cannot impersonate yourself"
+        end
+      end
+    end
+  end
+end

data/app/errors/command_tower/errors/continuation_exhausted_error.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Errors
+    class ContinuationExhaustedError < ApplicationError
+      def code
+        "continuation_exhausted"
+      end
+
+      def message
+        attempt = details.is_a?(Hash) ? details[:attempt] : nil
+        max_attempts = details.is_a?(Hash) ? details[:max_attempts] : nil
+        if attempt && max_attempts
+          "delayed continuation exhausted after attempt #{attempt} of #{max_attempts}"
+        else
+          "delayed continuation exhausted"
+        end
+      end
+
+      def log_level
+        :error
+      end
+    end
+  end
+end

data/app/jobs/command_tower/application_job.rb

@@ -1,4 +1,11 @@
+# frozen_string_literal: true
+
 module CommandTower
   class ApplicationJob < ActiveJob::Base
+    include CommandTower::Execution::JobBoundary
+
+    def execute_workflow(workflow_class, **args)
+      workflow_class.call_from_job(job: self, **args)
+    end
   end
 end