command_tower 0.3.1 → 0.10.0

data/app/services/command_tower/services/account/phone_verification/send.rb

@@ -0,0 +1,114 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Account
+      module PhoneVerification
+        # Issues a one-time phone verification code and delivers it over SMS.
+        class Send < CommandTower::Services::ApplicationService
+          validate :user, is_a: User, required: true
+
+          def call
+            send_unavailable! unless configuration.enable
+
+            phone = user.phone_number.to_s.strip
+            phone_missing! if phone.blank?
+            already_verified! if user.phone_number_validated
+
+            enforce_resend_cooldown!
+
+            issued = issue_code(phone)
+            deliver(phone, issued.secret)
+
+            context.code_length = configuration.verify_code_length
+            context.expires_at = issued.record.death_time
+            context.phone_number = phone
+            context.resend_available_at = Time.current + configuration.resend_cooldown
+          end
+
+          private
+
+          def configuration
+            CommandTower.config.identity.phone_verification
+          end
+
+          def enforce_resend_cooldown!
+            cooldown = configuration.resend_cooldown
+            return if cooldown.nil? || cooldown <= 0.seconds
+
+            latest = UserSecret
+              .where(user:, reason: CommandTower::Secrets::PHONE_VERIFICATION)
+              .order(created_at: :desc)
+              .first
+            return if latest.nil?
+
+            available_at = latest.created_at + cooldown
+            return if Time.current >= available_at
+
+            context.fail!(
+              application_error: CommandTower::Errors::Account::PhoneVerificationThrottledError.new(
+                resend_available_at: available_at
+              )
+            )
+          end
+
+          def issue_code(phone)
+            result = CommandTower::Secrets::Generate.(
+              user:,
+              secret_length: configuration.verify_code_length,
+              reason: CommandTower::Secrets::PHONE_VERIFICATION,
+              type: CommandTower::Secrets::NUMERIC,
+              use_count_max: 1,
+              death_time: configuration.verify_code_valid_for,
+              extra: phone,
+              cleanse: true
+            )
+
+            if result.failure?
+              log_error("Unable to issue a phone verification code for user [#{user.id}]")
+              context.fail!(application_error: CommandTower::Errors::InternalError.new)
+            end
+
+            result
+          end
+
+          def deliver(phone, secret)
+            delivery = CommandTower::Identity::PhoneVerification::SmsTransport.deliver(
+              to: phone,
+              body: "Your verification code is #{secret}"
+            )
+            return if delivery.success?
+
+            log_error(
+              {
+                event: "phone_verification_sms_failed",
+                error_code: delivery.error_code,
+                to_masked: mask_phone(phone)
+              }.to_json
+            )
+            context.fail!(application_error: CommandTower::Errors::Account::PhoneVerificationSendFailedError.new)
+          end
+
+          def send_unavailable!
+            context.fail!(application_error: CommandTower::Errors::Account::PhoneVerificationSendFailedError.new)
+          end
+
+          def phone_missing!
+            context.fail!(application_error: CommandTower::Errors::Account::PhoneMissingError.new)
+          end
+
+          def already_verified!
+            context.fail!(application_error: CommandTower::Errors::Account::PhoneAlreadyVerifiedError.new)
+          end
+
+          def mask_phone(value)
+            digits = value.to_s.gsub(/\D/, "")
+            return "[redacted]" if digits.length < 4
+
+            "#{"*" * (digits.length - 4)}#{digits[-4,]}"
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/account/phone_verification/verify.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Account
+      module PhoneVerification
+        # Redeems a phone verification code and marks the phone validated.
+        class Verify < CommandTower::Services::ApplicationService
+          EXPIRED_FRAGMENT = "Expired"
+
+          validate :user, is_a: User, required: true
+          validate :code, is_a: String, required: true, sensitive: true
+
+          def call
+            phone_missing! if user.phone_number.to_s.strip.blank?
+
+            if user.phone_number_validated
+              context.user = user
+              context.already_verified = true
+              return
+            end
+
+            User.transaction do
+              locked = User.lock.find(user.id)
+              phone = locked.phone_number.to_s.strip
+
+              phone_missing! if phone.blank?
+
+              if locked.phone_number_validated
+                context.user = locked
+                context.already_verified = true
+                return
+              end
+
+              redeem!(locked, phone)
+
+              locked.update!(phone_number_validated: true)
+              CommandTower::Secrets::Cleanse.(user: locked, reason: CommandTower::Secrets::PHONE_VERIFICATION)
+              context.user = locked.reload
+              context.already_verified = false
+            end
+          end
+
+          private
+
+          def redeem!(locked, phone)
+            challenge = UserSecret.find_by(
+              secret: code,
+              reason: CommandTower::Secrets::PHONE_VERIFICATION
+            )
+
+            invalid_code! if challenge.nil? || challenge.user_id != locked.id
+            stale_challenge! if challenge.extra.to_s != phone
+
+            result = CommandTower::Secrets::Verify.(
+              secret: code,
+              reason: CommandTower::Secrets::PHONE_VERIFICATION,
+              access_count: true
+            )
+
+            if result.failure?
+              expired_code! if result.msg.to_s.include?(EXPIRED_FRAGMENT)
+              invalid_code!
+            end
+
+            invalid_code! if result.user != locked
+          end
+
+          def phone_missing!
+            context.fail!(application_error: CommandTower::Errors::Account::PhoneMissingError.new)
+          end
+
+          def invalid_code!
+            context.fail!(application_error: CommandTower::Errors::Account::PhoneVerificationCodeInvalidError.new)
+          end
+
+          def stale_challenge!
+            context.fail!(application_error: CommandTower::Errors::Account::PhoneVerificationStaleError.new)
+          end
+
+          def expired_code!
+            context.fail!(application_error: CommandTower::Errors::Account::PhoneVerificationExpiredError.new)
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/account/pushover/create.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Account
+      module Pushover
+        class Create < CommandTower::Services::ApplicationService
+          validate :user, is_a: User, required: true
+          validate :user_key, is_a: String, required: true
+          validate :application_token, is_a: String, required: true
+
+          def call
+            context.safe_view = CommandTower::Messaging::Endpoints.create(
+              owner_user_id: user.id,
+              channel_key: "pushover",
+              credentials: {
+                user_key:,
+                application_token:
+              }
+            )
+          rescue CommandTower::Messaging::Endpoints::Error => e
+            context.fail!(application_error: CtSupport.map_ct_exception!(e))
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/account/pushover/ct_support.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Account
+      module Pushover
+        # Shared CT Endpoints helpers for Account Pushover capability services.
+        module CtSupport
+          module_function
+
+          def active_endpoint(user)
+            views = CommandTower::Messaging::Endpoints.list(
+              owner_user_id: user.id,
+              channel_key: "pushover"
+            )
+            views.find { |view| view.lifecycle_state.to_s == "active" }
+          end
+
+          def map_ct_exception!(error)
+            case error
+            when CommandTower::Messaging::Endpoints::VerificationFailedError
+              map_verification_failed!(error)
+            when CommandTower::Messaging::Endpoints::ConflictError
+              CommandTower::Errors::Account::PushoverAlreadyConfiguredError.new
+            when CommandTower::Messaging::Endpoints::NotFoundError
+              CommandTower::Errors::Account::PushoverNotConfiguredError.new
+            when CommandTower::Messaging::Endpoints::ValidationError
+              if error.message.to_s.include?("disabled")
+                CommandTower::Errors::Account::PushoverCapabilityUnavailableError.new
+              else
+                CommandTower::Errors::ValidationError.new(details: { base: "Invalid Pushover credentials" })
+              end
+            else
+              CommandTower::Errors::InternalError.new
+            end
+          end
+
+          def map_verification_failed!(error)
+            case error.error_code
+            when :invalid_user
+              CommandTower::Errors::Account::PushoverVerificationFailedError.new(
+                code: "pushover_invalid_user",
+                message: "Pushover user key is invalid"
+              )
+            when :invalid_token
+              CommandTower::Errors::Account::PushoverVerificationFailedError.new(
+                code: "pushover_invalid_token",
+                message: "Pushover application token is invalid"
+              )
+            when :invalid_credentials
+              CommandTower::Errors::Account::PushoverVerificationFailedError.new(
+                code: "pushover_invalid_credentials",
+                message: "Pushover credentials were rejected"
+              )
+            when :timeout
+              CommandTower::Errors::Account::PushoverVerificationFailedError.new(
+                code: "pushover_provider_timeout",
+                message: "Pushover provider timed out"
+              )
+            when :provider_unavailable
+              CommandTower::Errors::Account::PushoverProviderUnavailableError.new
+            else
+              CommandTower::Errors::Account::PushoverVerificationFailedError.new
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/account/pushover/destroy.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Account
+      module Pushover
+        class Destroy < CommandTower::Services::ApplicationService
+          validate :user, is_a: User, required: true
+
+          def call
+            active = CtSupport.active_endpoint(user)
+            if active.nil?
+              context.fail!(application_error: CommandTower::Errors::Account::PushoverNotConfiguredError.new)
+              return
+            end
+
+            begin
+              context.safe_view = CommandTower::Messaging::Endpoints.revoke(
+                owner_user_id: user.id,
+                endpoint_id: active.id
+              )
+            rescue CommandTower::Messaging::Endpoints::Error => e
+              context.fail!(application_error: CtSupport.map_ct_exception!(e))
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/account/pushover/replace.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Account
+      module Pushover
+        class Replace < CommandTower::Services::ApplicationService
+          validate :user, is_a: User, required: true
+          validate :user_key, is_a: String, required: true
+          validate :application_token, is_a: String, required: true
+
+          def call
+            context.safe_view = CommandTower::Messaging::Endpoints.replace(
+              owner_user_id: user.id,
+              channel_key: "pushover",
+              credentials: {
+                user_key:,
+                application_token:
+              }
+            )
+          rescue CommandTower::Messaging::Endpoints::Error => e
+            context.fail!(application_error: CtSupport.map_ct_exception!(e))
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/account/pushover/show.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Account
+      module Pushover
+        class Show < CommandTower::Services::ApplicationService
+          validate :user, is_a: User, required: true
+
+          def call
+            context.safe_view = CtSupport.active_endpoint(user)
+          rescue CommandTower::Messaging::Endpoints::Error => e
+            context.fail!(application_error: CtSupport.map_ct_exception!(e))
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/account/pushover/verify.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Account
+      module Pushover
+        class Verify < CommandTower::Services::ApplicationService
+          validate :user, is_a: User, required: true
+
+          def call
+            active = CtSupport.active_endpoint(user)
+            if active.nil?
+              context.fail!(application_error: CommandTower::Errors::Account::PushoverNotConfiguredError.new)
+              return
+            end
+
+            begin
+              context.safe_view = CommandTower::Messaging::Endpoints.verify_pushover!(
+                owner_user_id: user.id,
+                endpoint_id: active.id
+              )
+            rescue CommandTower::Messaging::Endpoints::Error => e
+              context.fail!(application_error: CtSupport.map_ct_exception!(e))
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/account/update_phone.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Account
+      # Sets or replaces the user's canonical phone number. Never marks it verified.
+      class UpdatePhone < CommandTower::Services::ApplicationService
+        DUPLICATE_MESSAGE = "has already been taken"
+
+        validate :user, is_a: User, required: true
+        validate :phone_number, is_a: String, required: true
+
+        def call
+          normalized = normalize
+
+          if user.phone_number == normalized
+            context.user = user
+            return
+          end
+
+          user.phone_number = normalized
+          user.phone_number_validated = false
+
+          begin
+            user.save!
+          rescue ActiveRecord::RecordNotUnique
+            reject!(DUPLICATE_MESSAGE)
+          end
+
+          context.user = user
+        end
+
+        private
+
+        def normalize
+          result = CommandTower::Identity::Phone::Normalizer.call(phone_number:)
+          reject!(result.message) if result.failure?
+
+          result.normalized
+        end
+
+        def reject!(message)
+          context.fail!(
+            application_error: CommandTower::Errors::ValidationError.new(details: { phoneNumber: message })
+          )
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/application_service.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    class ApplicationService < CommandTower::ServiceBase
+      on_argument_validation :fail_early
+
+      def self.inherited(subclass)
+        super
+        subclass.on_argument_validation(:fail_early)
+      end
+
+      class << self
+        def call(context = {})
+          interactor_context = super
+          ServiceResult.from_interactor_context(interactor_context)
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/authenticate_session.rb

@@ -0,0 +1,105 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      class AuthenticateSession < CommandTower::Services::ApplicationService
+        validate :request_context, is_a: CommandTower::Auth::RequestContext, required: true
+        validate :bypass_email_validation, is_one: [true, false], default: false
+
+        def call
+          request = request_context.request
+          token_data = CommandTower::Jwt::AuthorizationHelper.extract_token(request)
+
+          if token_data[:error]
+            return fail_authentication!(
+              CommandTower::Errors::UnauthorizedError.new,
+              token_source: nil
+            )
+          end
+
+          token = token_data[:token]
+          token_source = token_data[:source]
+
+          if csrf_required?(request, token_source)
+            csrf_validation = CommandTower::Jwt::CsrfHelper.validate(request)
+            unless csrf_validation[:valid]
+              fail_authentication!(
+                csrf_error_for(csrf_validation[:message]),
+                token_source: :cookie
+              )
+              return
+            end
+          end
+
+          with_reset = CommandTower::Jwt::AuthorizationHelper.get_with_reset_flag(request) || false
+          auth_result = CommandTower::Jwt::AuthenticateUser.call(
+            token:,
+            with_reset:,
+            bypass_email_validation:
+          )
+          if auth_result.success?
+            context.user = auth_result.user
+            context.token_expires_at = auth_result.expires_at
+            context.generated_token = auth_result.generated_token if with_reset
+            context.service_metadata = observation_metadata(
+              token_source:,
+              authentication_failed: false,
+              cookie_authenticated: token_source == :cookie
+            )
+            return
+          end
+
+          if auth_result.status == 412
+            fail_authentication!(
+              CommandTower::Errors::Auth::EmailVerificationRequiredError.new,
+              token_source:
+            )
+            return
+          end
+
+          fail_authentication!(CommandTower::Errors::UnauthorizedError.new, token_source:)
+        end
+
+        private
+
+        def fail_authentication!(error, token_source:)
+          context.service_metadata = observation_metadata(
+            token_source:,
+            authentication_failed: true,
+            cookie_authenticated: token_source == :cookie
+          )
+          context.fail!(application_error: error)
+        end
+
+        def observation_metadata(token_source:, authentication_failed:, cookie_authenticated: nil)
+          {
+            token_source:,
+            authentication_mechanism: :jwt,
+            authentication_failed:,
+            cookie_authenticated: cookie_authenticated.nil? ? token_source == :cookie : cookie_authenticated
+          }
+        end
+
+        def csrf_error_for(message)
+          case message
+          when "csrf_mismatch"
+            CommandTower::Errors::Auth::CsrfMismatchError.new
+          else
+            CommandTower::Errors::Auth::CsrfMissingError.new
+          end
+        end
+
+        # Enforcement lives here because token_source is only reliably known once
+        # the token has been extracted.
+        def csrf_required?(request, token_source)
+          return false unless CommandTower::Jwt::CsrfHelper.csrf_enabled?
+          return false unless token_source == :cookie
+          return false if request.get? || request.head? || request.options?
+
+          %w[POST PUT PATCH DELETE].include?(request.method)
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/authorize_request.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      class AuthorizeRequest < CommandTower::Services::ApplicationService
+        validate :current_user, is_a: User, required: true
+        validate :controller_class, is_a: Class, required: true
+        validate :action_name, is_a: String, required: true
+
+        def call
+          result = CommandTower::Authorize::Validate.call(
+            user: current_user,
+            controller: controller_class,
+            method: action_name
+          )
+
+          context.authorization_required = result.authorization_required
+
+          if result.failure?
+            context.fail!(application_error: CommandTower::Errors::ForbiddenError.new)
+            return
+          end
+
+          # Fail closed: an action the host never mapped into RBAC is not
+          # implicitly public once it sits behind the authorization boundary.
+          unless result.authorization_required
+            context.fail!(application_error: CommandTower::Errors::ForbiddenError.new)
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/client_ip_resolver.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      class ClientIpResolver
+        def self.call(request:)
+          request.remote_ip.to_s
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/email_availability.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      class EmailAvailability < CommandTower::Services::ApplicationService
+        validate :email, is_a: String, required: true, sensitive: true
+
+        def call
+          normalized = email.strip.downcase
+
+          unless valid_format?(normalized)
+            context.valid = false
+            context.available = false
+            context.message = "Enter a valid email address."
+            return
+          end
+
+          if ::User.exists?(email: normalized)
+            context.valid = true
+            context.available = false
+            context.message = "Email is already registered"
+          else
+            context.valid = true
+            context.available = true
+            context.message = "Email is available"
+          end
+        end
+
+        private
+
+        def valid_format?(normalized)
+          return false unless normalized.match?(URI::MailTo::EMAIL_REGEXP)
+
+          plain_text = CommandTower.config.login.plain_text
+          length = normalized.length
+          length > plain_text.email_length_min && length < plain_text.email_length_max
+        end
+      end
+    end
+  end
+end