command_tower 0.10.0 → 0.11.0

data/app/services/command_tower/services/impersonation/terminate_open_sessions.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Impersonation
+      class TerminateOpenSessions < CommandTower::Services::ApplicationService
+        validate :actor_user_id, is_a: Integer, required: true
+        validate :reason, is_a: String, required: true
+
+        def call
+          unless CommandTower::Impersonation::Session::END_REASONS.include?(reason)
+            return context.fail!(application_error: CommandTower::Errors::InternalError.new)
+          end
+
+          ids = CommandTower::Impersonation::Session.open.where(actor_user_id:).pluck(:id)
+          ended_count = 0
+          ids.each do |session_id|
+            ended = CommandTower::Services::Impersonation::End.call(
+              session_id:,
+              reason:,
+              actor_user_id:
+            )
+            next unless ended.success? && ended.data[:ended]
+
+            ended_count += 1
+            emit_ended(ended.data[:session], reason:)
+          end
+          context.ended_count = ended_count
+        end
+
+        private
+
+        def emit_ended(session, reason:)
+          target = User.find_by(id: session.target_user_id)
+          return if target.nil?
+
+          CommandTower::Impersonation::ClearOverlayForAudit.call(actor_user_id:) do
+            audit(
+              :impersonation_ended,
+              subject: target,
+              affected_user: target,
+              changes: { reason: { from: nil, to: reason } },
+              metadata: { impersonation_session_id: session.id },
+              attribution_mode: :admin_direct
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/me/change_password.rb

@@ -42,11 +42,23 @@ module CommandTower
 
             begin
               user.reset_verifier_token!
+              CommandTower::Services::Impersonation::TerminateOpenSessions.call(
+                actor_user_id: user.id,
+                reason: "revoked"
+              )
             rescue StandardError => e
               log_error("Failed to rotate session verifier for user [#{user.id}]: #{e.class}")
               infrastructure_failure = true
               raise ActiveRecord::Rollback
             end
+
+            audit(
+              :password_changed,
+              subject: user,
+              affected_user: user,
+              changes: {},
+              metadata: { mechanism: "authenticated_change" }
+            )
           end
 
           if persistence_errors

data/app/shared_sequences/command_tower/shared_sequences/admin/users/resolve_scoped_user.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module SharedSequences
+    module Admin
+      module Users
+        class ResolveScopedUser
+          Result = Data.define(:user)
+
+          def self.call(id:, principal:, scope_value: nil)
+            new.call(id:, principal:, scope_value:)
+          end
+
+          def call(id:, principal:, scope_value: nil)
+            scope_result = CommandTower::Workflows::Admin::ScopeResolution.resolve(
+              tool_id: "users",
+              user: principal,
+              scope_value:
+            )
+            return scope_result if scope_result.is_a?(CommandTower::Workflows::WorkflowResult)
+
+            shown = CommandTower::Services::Admin::Users::Show.call(
+              id:,
+              principal:,
+              scope_context: scope_result
+            )
+            unless shown.success?
+              return CommandTower::Workflows::WorkflowResult.failure(
+                errors: shown.errors,
+                http_status: CommandTower::Workflows::Admin::Users::ErrorMapping.http_status_for(
+                  shown.errors.first
+                )
+              )
+            end
+
+            Result.new(user: shown.data[:user])
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/transactional.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module CommandTower
+  # Generic ActiveRecord atomic boundary shared by ApplicationWorkflow and ApplicationService.
+  # Layer-specific result contracts are supplied by includers.
+  module Transactional
+    class TransactionFailure < StandardError
+      attr_reader :result
+
+      def initialize(result)
+        @result = result
+        super("transaction failed")
+      end
+    end
+
+    class InvalidTransactionResult < StandardError; end
+
+    def transaction
+      result = nil
+      ActiveRecord::Base.transaction do
+        result = yield
+        validate_transaction_success!(result)
+      end
+      result
+    rescue TransactionFailure => e
+      handle_transaction_failure(e.result)
+    end
+
+    def fail_transaction!(result)
+      unless acceptable_failure_result?(result)
+        raise InvalidTransactionResult, fail_transaction_type_error_message
+      end
+
+      raise TransactionFailure.new(result)
+    end
+
+    private
+
+    def validate_transaction_success!(result)
+      return if acceptable_success_result?(result)
+
+      raise InvalidTransactionResult, invalid_success_result_message(result)
+    end
+
+    def acceptable_success_result?(_result)
+      raise NotImplementedError, "#{self.class} must implement #acceptable_success_result?"
+    end
+
+    def acceptable_failure_result?(_result)
+      raise NotImplementedError, "#{self.class} must implement #acceptable_failure_result?"
+    end
+
+    def fail_transaction_type_error_message
+      "fail_transaction! requires a failed result"
+    end
+
+    def invalid_success_result_message(result)
+      "transaction block returned a non-success result; got #{result.class}"
+    end
+
+    def handle_transaction_failure(result)
+      result
+    end
+  end
+end

data/app/workflows/command_tower/workflows/admin/messaging/create_announcement_workflow.rb

@@ -30,6 +30,17 @@ module CommandTower
               )
             end
 
+            audit(
+              :announcement_produced,
+              changes: {},
+              metadata: {
+                campaign_identity: input.campaign_identity,
+                notification_type_key: input.notification_type_key,
+                recipient_count: user_ids.size
+              },
+              attribution_mode: :admin_direct
+            )
+
             success(
               payload: CommandTower::Serializers::Admin::Messaging::AnnouncementResponseSerializer.serialize(
                 result.data

data/app/workflows/command_tower/workflows/admin/scope_resolution.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Admin
+      module ScopeResolution
+        module_function
+
+        def resolve(tool_id:, user:, scope_value:)
+          CommandTower::AdminScope::Resolve.call(tool_id:, principal: user, scope_value:)
+        rescue CommandTower::Errors::ForbiddenError => error
+          CommandTower::Workflows::WorkflowResult.failure(errors: [error], http_status: :forbidden)
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/admin/users/error_mapping.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Admin
+      module Users
+        module ErrorMapping
+          module_function
+
+          def http_status_for(error)
+            case error
+            when CommandTower::Errors::ValidationError
+              :unprocessable_entity
+            when CommandTower::Errors::ForbiddenError
+              :forbidden
+            when CommandTower::Errors::NotFoundError
+              :not_found
+            else
+              :internal_server_error
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/admin/users/identity_mutation.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Admin
+      module Users
+        module IdentityMutation
+          module_function
+
+          def resolve_target(id:, principal:, scope_value:)
+            CommandTower::SharedSequences::Admin::Users::ResolveScopedUser.call(
+              id:,
+              principal:,
+              scope_value:
+            )
+          end
+
+          def map_service_failure(result)
+            CommandTower::Workflows::WorkflowResult.failure(
+              errors: result.errors,
+              http_status: CommandTower::Workflows::Admin::Users::ErrorMapping.http_status_for(
+                result.errors.first
+              )
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/admin/users/list_assignable_roles_workflow.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Admin
+      module Users
+        class ListAssignableRolesWorkflow < CommandTower::Workflows::ApplicationWorkflow
+          retry_strategy :none
+
+          def call
+            listed = CommandTower::Services::Admin::Users::ListAssignableRoles.call
+            unless listed.success?
+              return failure(
+                errors: listed.errors,
+                http_status: ErrorMapping.http_status_for(listed.errors.first)
+              )
+            end
+
+            success(
+              payload: CommandTower::Serializers::Admin::Users::AssignableRolesSerializer.serialize(
+                listed.data[:roles]
+              ),
+              http_status: :ok
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/admin/users/list_workflow.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Admin
+      module Users
+        class ListWorkflow < CommandTower::Workflows::ApplicationWorkflow
+          retry_strategy :none
+
+          def call(limit:, offset:, search: nil, user:, scope_value: nil)
+            scope_result = resolve_scope(user:, scope_value:)
+            return scope_result if scope_result.is_a?(CommandTower::Workflows::WorkflowResult)
+
+            listed = CommandTower::Services::Admin::Users::List.call(
+              limit:,
+              offset:,
+              search:,
+              principal: user,
+              scope_context: scope_result
+            )
+            return result_or_failure(listed) unless listed.success?
+
+            payload = listed.data[:users].map do |user|
+              CommandTower::Serializers::Admin::Users::UserSerializer.serialize(user)
+            end
+            meta = CommandTower::Serializers::Admin::Users::PaginationMetaSerializer.serialize(
+              listed.data[:pagination]
+            )
+            success(payload:, meta:, http_status: :ok)
+          end
+
+          private
+
+          def resolve_scope(user:, scope_value:)
+            CommandTower::Workflows::Admin::ScopeResolution.resolve(
+              tool_id: "users",
+              user:,
+              scope_value:
+            )
+          end
+
+          def result_or_failure(result)
+            failure(
+              errors: result.errors,
+              http_status: CommandTower::Workflows::Admin::Users::ErrorMapping.http_status_for(
+                result.errors.first
+              )
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/admin/users/set_email_validated_workflow.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Admin
+      module Users
+        class SetEmailValidatedWorkflow < CommandTower::Workflows::ApplicationWorkflow
+          retry_strategy :none
+
+          def call(id:, user:, email_validated:, scope_value: nil)
+            resolved = IdentityMutation.resolve_target(id:, principal: user, scope_value:)
+            return resolved if resolved.is_a?(CommandTower::Workflows::WorkflowResult)
+
+            target = resolved.user
+            previous = target.email_validated
+
+            transaction do
+              result = CommandTower::Services::Admin::Users::SetEmailValidated.call(
+                user: target,
+                email_validated:
+              )
+              fail_transaction!(IdentityMutation.map_service_failure(result)) unless result.success?
+
+              updated = result.data[:user]
+              if result.data[:changed]
+                audit(
+                  :admin_user_email_validation_changed,
+                  subject: updated,
+                  affected_user: updated,
+                  changes: { email_validated: { from: previous, to: updated.email_validated } },
+                  attribution_mode: :admin_direct
+                )
+              end
+
+              success(
+                payload: CommandTower::Serializers::Admin::Users::UserSerializer.serialize(updated),
+                http_status: :ok
+              )
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/admin/users/show_workflow.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Admin
+      module Users
+        class ShowWorkflow < CommandTower::Workflows::ApplicationWorkflow
+          retry_strategy :none
+
+          def call(id:, user:, scope_value: nil)
+            scope_result = resolve_scope(user:, scope_value:)
+            return scope_result if scope_result.is_a?(CommandTower::Workflows::WorkflowResult)
+
+            shown = CommandTower::Services::Admin::Users::Show.call(
+              id:,
+              principal: user,
+              scope_context: scope_result
+            )
+            return result_or_failure(shown) unless shown.success?
+
+            payload = CommandTower::Serializers::Admin::Users::UserSerializer.serialize(
+              shown.data[:user]
+            )
+            success(payload:, http_status: :ok)
+          end
+
+          private
+
+          def resolve_scope(user:, scope_value:)
+            CommandTower::Workflows::Admin::ScopeResolution.resolve(
+              tool_id: "users",
+              user:,
+              scope_value:
+            )
+          end
+
+          def result_or_failure(result)
+            failure(
+              errors: result.errors,
+              http_status: CommandTower::Workflows::Admin::Users::ErrorMapping.http_status_for(
+                result.errors.first
+              )
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/admin/users/update_email_workflow.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Admin
+      module Users
+        class UpdateEmailWorkflow < CommandTower::Workflows::ApplicationWorkflow
+          retry_strategy :none
+
+          def call(id:, user:, email:, scope_value: nil)
+            resolved = IdentityMutation.resolve_target(id:, principal: user, scope_value:)
+            return resolved if resolved.is_a?(CommandTower::Workflows::WorkflowResult)
+
+            target = resolved.user
+
+            transaction do
+              result = CommandTower::Services::Admin::Users::UpdateEmail.call(
+                user: target,
+                email:
+              )
+              fail_transaction!(IdentityMutation.map_service_failure(result)) unless result.success?
+
+              updated = result.data[:user]
+              if result.data[:changed]
+                audit(
+                  :admin_user_email_changed,
+                  subject: updated,
+                  affected_user: updated,
+                  changes: {},
+                  metadata: { email_changed: true },
+                  attribution_mode: :admin_direct
+                )
+              end
+
+              success(
+                payload: CommandTower::Serializers::Admin::Users::UserSerializer.serialize(updated),
+                http_status: :ok
+              )
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/admin/users/update_name_workflow.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Admin
+      module Users
+        class UpdateNameWorkflow < CommandTower::Workflows::ApplicationWorkflow
+          retry_strategy :none
+
+          def call(id:, user:, first_name:, last_name:, scope_value: nil)
+            resolved = IdentityMutation.resolve_target(id:, principal: user, scope_value:)
+            return resolved if resolved.is_a?(CommandTower::Workflows::WorkflowResult)
+
+            target = resolved.user
+            previous = { first_name: target.first_name, last_name: target.last_name }
+
+            transaction do
+              result = CommandTower::Services::Admin::Users::UpdateName.call(
+                user: target,
+                first_name:,
+                last_name:
+              )
+              fail_transaction!(IdentityMutation.map_service_failure(result)) unless result.success?
+
+              updated = result.data[:user]
+              if result.data[:changed]
+                audit(
+                  :admin_user_name_changed,
+                  subject: updated,
+                  affected_user: updated,
+                  changes: {
+                    first_name: { from: previous[:first_name], to: updated.first_name },
+                    last_name: { from: previous[:last_name], to: updated.last_name }
+                  },
+                  attribution_mode: :admin_direct
+                )
+              end
+
+              success(
+                payload: CommandTower::Serializers::Admin::Users::UserSerializer.serialize(updated),
+                http_status: :ok
+              )
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/admin/users/update_roles_workflow.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Admin
+      module Users
+        class UpdateRolesWorkflow < CommandTower::Workflows::ApplicationWorkflow
+          retry_strategy :none
+
+          def call(id:, user:, roles:, scope_value: nil)
+            resolved = IdentityMutation.resolve_target(id:, principal: user, scope_value:)
+            return resolved if resolved.is_a?(CommandTower::Workflows::WorkflowResult)
+
+            target = resolved.user
+            policy = CommandTower::Services::Admin::Users::RoleAssignmentPolicy.call(
+              actor: user,
+              target:,
+              desired_roles: roles
+            )
+            return IdentityMutation.map_service_failure(policy) unless policy.success?
+
+            transaction do
+              result = CommandTower::Services::Admin::Users::ReplaceUserRoles.call(
+                user: target,
+                desired_roles: policy.data[:desired_roles]
+              )
+              fail_transaction!(IdentityMutation.map_service_failure(result)) unless result.success?
+
+              updated = result.data[:user]
+              if result.data[:changed]
+                Array(result.data[:assigned_roles]).each do |role_name|
+                  audit(
+                    :role_assigned,
+                    subject: updated,
+                    affected_user: updated,
+                    changes: { role: { from: nil, to: role_name.to_s } },
+                    attribution_mode: :admin_direct
+                  )
+                end
+                Array(result.data[:revoked_roles]).each do |role_name|
+                  audit(
+                    :role_revoked,
+                    subject: updated,
+                    affected_user: updated,
+                    changes: { role: { from: role_name.to_s, to: nil } },
+                    attribution_mode: :admin_direct
+                  )
+                end
+              end
+
+              success(
+                payload: CommandTower::Serializers::Admin::Users::UserSerializer.serialize(updated),
+                http_status: :ok
+              )
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/admin/users/update_username_workflow.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Admin
+      module Users
+        class UpdateUsernameWorkflow < CommandTower::Workflows::ApplicationWorkflow
+          retry_strategy :none
+
+          def call(id:, user:, username:, scope_value: nil)
+            resolved = IdentityMutation.resolve_target(id:, principal: user, scope_value:)
+            return resolved if resolved.is_a?(CommandTower::Workflows::WorkflowResult)
+
+            target = resolved.user
+            previous_username = target.username
+
+            transaction do
+              result = CommandTower::Services::Admin::Users::UpdateUsername.call(
+                user: target,
+                username:
+              )
+              fail_transaction!(IdentityMutation.map_service_failure(result)) unless result.success?
+
+              updated = result.data[:user]
+              if result.data[:changed]
+                audit(
+                  :admin_user_username_changed,
+                  subject: updated,
+                  affected_user: updated,
+                  changes: { username: { from: previous_username, to: updated.username } },
+                  attribution_mode: :admin_direct
+                )
+              end
+
+              success(
+                payload: CommandTower::Serializers::Admin::Users::UserSerializer.serialize(updated),
+                http_status: :ok
+              )
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/admin/workspace/manifest_workflow.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Admin
+      module Workspace
+        class ManifestWorkflow < CommandTower::Workflows::ApplicationWorkflow
+          retry_strategy :none
+
+          def call(user:)
+            result = CommandTower::Services::Admin::Workspace::Manifest.call(user:)
+            unless result.success?
+              return failure(errors: result.errors, http_status: :unprocessable_entity)
+            end
+
+            success(
+              payload: CommandTower::Serializers::Admin::Workspace::ManifestSerializer.serialize(result.data[:tools]),
+              http_status: :ok
+            )
+          end
+        end
+      end
+    end
+  end
+end