command_tower 0.3.1 → 0.10.0

data/app/services/command_tower/services/auth/password_reset/validate.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      module PasswordReset
+        # Reports whether a reset token is still usable without consuming it.
+        class Validate < CommandTower::Services::ApplicationService
+          include TokenVerification
+
+          validate :token, is_a: String, required: true, sensitive: true
+          validate :email, is_a: String, required: false, sensitive: true
+
+          def call
+            require_email!
+
+            redemption = redeem_token!(access_count: false)
+            match_email!(token_user: redemption.user)
+
+            log_info("Password reset token validated for user [#{redemption.user.id}]")
+
+            context.valid = true
+            context.expires_at = token_expires_at&.to_s
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/plain_text/login.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      module PlainText
+        class Login < CommandTower::Services::ApplicationService
+          validate :identifier, is_a: String, required: true, sensitive: true
+          validate :password, is_a: String, required: true, sensitive: true
+
+          def call
+            user = User.where(username: identifier).or(User.where(email: identifier)).first
+            invalid_credentials! if user.nil?
+
+            if user.authenticate(password)
+              user.successful_login += 1
+              user.password_consecutive_fail = 0
+              user.save
+            else
+              user.password_consecutive_fail += 1
+              user.save
+              log_warn("Valid identifier. Incorrect password. Consecutive Password failures: #{user.password_consecutive_fail}")
+              invalid_credentials!
+            end
+
+            context.user = user
+            context.token = CommandTower::Jwt::LoginCreate.(user:).token
+            context.expires_at = token_expires_at_from_ttl
+          end
+
+          private
+
+          def invalid_credentials!
+            context.fail!(application_error: CommandTower::Errors::Auth::InvalidCredentialsError.new)
+          end
+
+          def token_expires_at_from_ttl
+            CommandTower.config.jwt.ttl.from_now.to_time.to_s
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/register.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      class Register < CommandTower::Services::ApplicationService
+        EMAIL_TAKEN_FRAGMENT = "already been taken"
+
+        validate :first_name, is_a: String, required: true
+        validate :last_name, is_a: String, required: true
+        validate :username, is_a: String, required: true
+        validate :email, is_a: String, required: true, sensitive: true
+        validate :password, is_a: String, required: true, sensitive: true
+        validate :password_confirmation, is_a: String, required: true, sensitive: true
+
+        def call
+          errors = credential_errors
+          reject!(errors) if errors.any?
+
+          user = User.new(
+            first_name:,
+            last_name:,
+            username:,
+            email:,
+            password:,
+            password_confirmation:
+          )
+
+          reject!(persistence_errors(user)) unless user.save
+
+          context.user = user
+        end
+
+        private
+
+        def plain_text_config
+          CommandTower.config.login.plain_text
+        end
+
+        def credential_errors
+          config = plain_text_config
+          errors = {}
+
+          unless email.length > config.email_length_min && email.length < config.email_length_max
+            errors[:email] = "Email length must be between #{config.email_length_min + 1} and #{config.email_length_max - 1} characters"
+          end
+
+          unless password.length > config.password_length_min && password.length < config.password_length_max
+            errors[:password] = "Password length must be between #{config.password_length_min + 1} and #{config.password_length_max - 1} characters"
+          end
+
+          errors[:email] ||= "Invalid email address" unless email =~ URI::MailTo::EMAIL_REGEXP
+
+          unless CommandTower::Username::Available.(username:).valid?
+            errors[:username] = "Username is invalid. #{CommandTower.config.username.username_failure_message}"
+          end
+
+          errors
+        end
+
+        def persistence_errors(user)
+          user.errors.to_hash.transform_values { Array(_1).join(", ") }
+        end
+
+        def reject!(details)
+          if details[:email].to_s.downcase.include?(EMAIL_TAKEN_FRAGMENT)
+            context.fail!(
+              application_error: CommandTower::Errors::Auth::EmailAlreadyRegisteredError.new(details:)
+            )
+          end
+
+          context.fail!(application_error: CommandTower::Errors::ValidationError.new(details:))
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/signup_rate_limits/check_availability.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      module SignupRateLimits
+        class CheckAvailability < CommandTower::Services::ApplicationService
+          KINDS = %i[email username].freeze
+
+          include Enforcement
+
+          validate :signup_session, is_a: CommandTower::Auth::SignupSessionContext, required: true
+          validate :kind, is_one: KINDS, required: true
+
+          def call
+            remaining = signup_session.remaining_seconds
+            expired_session! if remaining <= 0
+
+            jti_ttl = remaining + CommandTower.config.signup_session.cleanup_buffer_seconds
+
+            enforce!(
+              key: "signup:rate:jti:#{signup_session.jti}:#{kind}",
+              ttl_seconds: jti_ttl,
+              limit: kind == :email ? limits.jti_email : limits.jti_username,
+              scope: :session
+            )
+
+            enforce!(
+              key: "signup:rate:jti:#{signup_session.jti}:total",
+              ttl_seconds: jti_ttl,
+              limit: limits.jti_total,
+              scope: :session
+            )
+
+            enforce!(
+              key: "signup:rate:ip:#{normalize_ip(signup_session.client_ip)}:availability:1h:#{hour_bucket}",
+              ttl_seconds: 3600,
+              limit: limits.ip_availability_hour,
+              scope: :ip
+            )
+          end
+
+          private
+
+          def expired_session!
+            context.fail!(application_error: CommandTower::Errors::Auth::SignupSessionExpiredError.new)
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/signup_rate_limits/check_register.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      module SignupRateLimits
+        class CheckRegister < CommandTower::Services::ApplicationService
+          include Enforcement
+
+          validate :client_ip, is_a: String, required: true
+
+          def call
+            enforce!(
+              key: "signup:rate:ip:#{normalize_ip(client_ip)}:register:1h:#{hour_bucket}",
+              ttl_seconds: 3600,
+              limit: limits.ip_register_hour,
+              scope: :ip
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/signup_rate_limits/check_token_issue.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      module SignupRateLimits
+        class CheckTokenIssue < CommandTower::Services::ApplicationService
+          include Enforcement
+
+          validate :client_ip, is_a: String, required: true
+
+          def call
+            ip_key = normalize_ip(client_ip)
+
+            enforce!(
+              key: "signup:rate:ip:#{ip_key}:issue:1m:#{minute_bucket}",
+              ttl_seconds: 60,
+              limit: limits.ip_issue_burst,
+              scope: :ip
+            )
+
+            enforce!(
+              key: "signup:rate:ip:#{ip_key}:issue:1h:#{hour_bucket}",
+              ttl_seconds: 3600,
+              limit: limits.ip_issue_hour,
+              scope: :ip
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/signup_rate_limits/enforcement.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      module SignupRateLimits
+        # Counter vocabulary shared by the signup rate limit services. Each
+        # service composes the buckets it cares about; this module owns how a
+        # single bucket is incremented and how a breach is reported.
+        module Enforcement
+          private
+
+          def limits
+            CommandTower.config.signup_session.rate_limits
+          end
+
+          def enforce!(key:, ttl_seconds:, limit:, scope:)
+            result = CommandTower::Services::RateLimits::Check.call(key: key, ttl_seconds: ttl_seconds)
+            context.fail!(application_error: result.errors.first) if result.failure?
+            return if result.data[:count] <= limit
+
+            context.fail!(application_error: rate_limit_error(scope, result.data[:ttl]))
+          end
+
+          def rate_limit_error(scope, ttl)
+            retry_after = ttl.positive? ? ttl : nil
+
+            if scope == :session
+              CommandTower::Errors::Auth::SignupSessionRateLimitError.new(retry_after_seconds: retry_after)
+            else
+              CommandTower::Errors::Auth::SignupIpRateLimitError.new(retry_after_seconds: retry_after)
+            end
+          end
+
+          def minute_bucket
+            Time.now.to_i / 60
+          end
+
+          def hour_bucket
+            Time.now.to_i / 3600
+          end
+
+          def normalize_ip(client_ip)
+            client_ip.to_s
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/signup_session/create.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      module SignupSession
+        class Create < CommandTower::Services::ApplicationService
+          def call
+            jti = SecureRandom.uuid
+            expires_at = CommandTower.config.signup_session.ttl.from_now.utc
+
+            encode_result = Encode.call(jti: jti, expires_at: expires_at)
+            unless encode_result.success?
+              context.fail!(application_error: CommandTower::Errors::InternalError.new)
+              return
+            end
+
+            context.token = encode_result.data[:token]
+            context.expires_at = expires_at
+            context.jti = jti
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/signup_session/decode.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require "jwt"
+
+module CommandTower
+  module Services
+    module Auth
+      module SignupSession
+        class Decode < CommandTower::Services::ApplicationService
+          validate :token, is_a: String, required: true, sensitive: true
+
+          def call
+            data = JWT.decode(
+              token,
+              CommandTower.config.signup_session.jwt_secret,
+              true,
+              { algorithm: "HS256" }
+            )
+            context.payload = data.first.with_indifferent_access
+          rescue JWT::ExpiredSignature
+            context.fail!(application_error: CommandTower::Errors::Auth::SignupSessionExpiredError.new)
+          rescue JWT::DecodeError
+            context.fail!(application_error: CommandTower::Errors::Auth::SignupSessionInvalidError.new)
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/signup_session/encode.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+require "jwt"
+
+module CommandTower
+  module Services
+    module Auth
+      module SignupSession
+        class Encode < CommandTower::Services::ApplicationService
+          validate :jti, is_a: String, required: true
+          validate :expires_at, is_a: Time, required: true
+
+          def call
+            config = CommandTower.config.signup_session
+
+            payload = {
+              iss: config.issuer,
+              aud: config.audience,
+              purpose: config.purpose,
+              jti: jti,
+              iat: Time.now.to_i,
+              exp: expires_at.to_i
+            }
+
+            context.token = JWT.encode(payload, config.jwt_secret, "HS256")
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/signup_session/validate.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      module SignupSession
+        class Validate < CommandTower::Services::ApplicationService
+          validate :token, is_a: String, required: true, sensitive: true
+          validate :client_ip, is_a: String, required: true
+
+          def call
+            decode_result = Decode.call(token: token)
+            unless decode_result.success?
+              context.fail!(application_error: decode_result.errors.first)
+              return
+            end
+
+            payload = decode_result.data[:payload]
+            validation_error = validate_claims(payload)
+            if validation_error
+              context.fail!(application_error: validation_error)
+              return
+            end
+
+            expires_at = Time.at(payload[:exp].to_i).utc
+            if expires_at <= Time.now.utc
+              context.fail!(application_error: CommandTower::Errors::Auth::SignupSessionExpiredError.new)
+              return
+            end
+
+            context.signup_session = CommandTower::Auth::SignupSessionContext.new(
+              jti: payload[:jti].to_s,
+              expires_at: expires_at,
+              client_ip: client_ip
+            )
+          end
+
+          private
+
+          def validate_claims(payload)
+            config = CommandTower.config.signup_session
+
+            return invalid_error if payload[:jti].blank?
+            return invalid_error if payload[:iss] != config.issuer
+            return invalid_error if payload[:aud] != config.audience
+            return invalid_error if payload[:purpose] != config.purpose
+
+            nil
+          end
+
+          def invalid_error
+            CommandTower::Errors::Auth::SignupSessionInvalidError.new
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/username_availability.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      class UsernameAvailability < CommandTower::Services::ApplicationService
+        validate :username, is_a: String, required: true
+
+        def call
+          availability = CommandTower::Username::Available.call(username:, force_query: true)
+
+          context.valid = availability.valid?
+          context.available = availability.available?
+          context.message = availability_message(valid: availability.valid?, available: availability.available?)
+        end
+
+        private
+
+        def availability_message(valid:, available:)
+          return CommandTower.config.username.username_failure_message unless valid
+          return "Username is available" if available
+
+          "Username is already taken"
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/me/capabilities.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Me
+      # Projects which Account self-service actions are enabled for the current user.
+      class Capabilities
+        def self.project(user)
+          new(user).project
+        end
+
+        def initialize(user)
+          @user = user
+        end
+
+        def project
+          {
+            editName: { enabled: true },
+            editUsername: { enabled: false },
+            changeEmail: { enabled: false },
+            changePassword: { enabled: true },
+            editPhone: { enabled: sms_enabled? },
+            editPushover: { enabled: pushover_enabled? },
+            logoutAllDevices: { enabled: false },
+            verifyEmail: { enabled: !user.email_validated }
+          }
+        end
+
+        private
+
+        attr_reader :user
+
+        def sms_enabled?
+          CommandTower::Messaging::ChannelDetectors.sms_product_ready?
+        end
+
+        def pushover_enabled?
+          CommandTower::Messaging::ChannelDetectors.pushover_configured?
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/me/change_password.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Me
+      class ChangePassword < CommandTower::Services::ApplicationService
+        FIELD_KEYS = {
+          current_password: :currentPassword,
+          password: :password,
+          password_confirmation: :passwordConfirmation
+        }.freeze
+
+        SUCCESS_MESSAGE = "Password has been successfully changed"
+
+        validate :user, is_a: User, required: true
+        validate :current_password, is_a: String, required: true, sensitive: true
+        validate :password, is_a: String, required: true, sensitive: true
+        validate :password_confirmation, is_a: String, required: true, sensitive: true
+
+        def call
+          reject!(current_password: "Incorrect current password") unless user.authenticate(current_password)
+          reject!(password_confirmation: "Password and confirmation do not match") unless password == password_confirmation
+
+          config = CommandTower.config.login.plain_text
+          if password.length < config.password_length_min || password.length > config.password_length_max
+            reject!(
+              password: "Password length must be between #{config.password_length_min} and #{config.password_length_max} characters"
+            )
+          end
+
+          persistence_errors = nil
+          infrastructure_failure = false
+
+          ActiveRecord::Base.transaction do
+            user.password = password
+            user.password_confirmation = password_confirmation
+
+            unless user.save
+              persistence_errors = user.errors.to_hash.transform_values { Array(_1).join(", ") }
+              raise ActiveRecord::Rollback
+            end
+
+            begin
+              user.reset_verifier_token!
+            rescue StandardError => e
+              log_error("Failed to rotate session verifier for user [#{user.id}]: #{e.class}")
+              infrastructure_failure = true
+              raise ActiveRecord::Rollback
+            end
+          end
+
+          if persistence_errors
+            log_error("Failed to update password for user [#{user.id}]")
+            reject!(persistence_errors)
+          end
+
+          if infrastructure_failure
+            context.fail!(application_error: CommandTower::Errors::InternalError.new)
+          end
+
+          # Detect silent rollback (neither branch set) — should not occur in normal paths
+          user.reload
+          unless user.authenticate(password)
+            log_error("Password change transaction did not persist for user [#{user.id}]")
+            context.fail!(application_error: CommandTower::Errors::InternalError.new)
+          end
+
+          log_info("Password changed successfully for user [#{user.id}]")
+          context.message = SUCCESS_MESSAGE
+        end
+
+        private
+
+        def reject!(errors)
+          details = errors.each_with_object({}) do |(key, message), mapped|
+            mapped[FIELD_KEYS.fetch(key.to_sym, key)] = message
+          end
+
+          context.fail!(application_error: CommandTower::Errors::ValidationError.new(details:))
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/me/pushover_product_gate.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Me
+      # Product gate for Pushover-dependent Me/Account endpoint lifecycle HTTP.
+      # Matches host Capabilities::Pushover.enabled? (pushover_configured?).
+      # Does not invent route constraints — callers return 503 when disabled.
+      module PushoverProductGate
+        module_function
+
+        def enabled?
+          CommandTower::Messaging::ChannelDetectors.pushover_configured?
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/me/sms_product_gate.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Me
+      # Product gate for SMS-dependent Me/Account phone lifecycle HTTP.
+      # Matches Me::Capabilities#sms_enabled? / host Capabilities::Sms.enabled?:
+      # Messaging notification SMS configured ∧ Identity OTP SMS ready.
+      # Does not invent route constraints — callers return 503 when disabled.
+      module SmsProductGate
+        module_function
+
+        def enabled?
+          CommandTower::Messaging::ChannelDetectors.sms_product_ready?
+        end
+      end
+    end
+  end
+end