command_tower 0.3.1 → 0.10.0

data/app/workflows/command_tower/workflows/auth/authorize_request_workflow.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Auth
+      class AuthorizeRequestWorkflow < CommandTower::Workflows::ApplicationWorkflow
+        retry_strategy :none
+
+        def call(current_user:, controller_class:, action_name:)
+          authorize_result = CommandTower::Services::Auth::AuthorizeRequest.call(
+            current_user: current_user,
+            controller_class: controller_class,
+            action_name: action_name
+          )
+
+          unless authorize_result.success?
+            return failure(
+              errors: authorize_result.errors,
+              http_status: :forbidden
+            )
+          end
+
+          success(payload: {}, http_status: :ok)
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/auth/email_availability_workflow.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Auth
+      class EmailAvailabilityWorkflow < CommandTower::Workflows::ApplicationWorkflow
+        retry_strategy :none
+
+        def call(input:, signup_session:)
+          rate_result = CommandTower::Services::Auth::SignupRateLimits::CheckAvailability.call(
+            signup_session: signup_session,
+            kind: :email
+          )
+          unless rate_result.success?
+            return failure(
+              errors: rate_result.errors,
+              http_status: SignupErrorStatus.http_status_for(rate_result.errors.first)
+            )
+          end
+
+          availability_result = CommandTower::Services::Auth::EmailAvailability.call(email: input.email)
+          unless availability_result.success?
+            return failure(errors: availability_result.errors, http_status: :internal_server_error)
+          end
+
+          data = availability_result.data
+          success(
+            payload: CommandTower::Serializers::Auth::EmailAvailabilitySerializer.serialize(
+              valid: data[:valid],
+              available: data[:available],
+              message: data[:message]
+            ),
+            http_status: :ok
+          )
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/auth/email_verification/send_workflow.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Auth
+      module EmailVerification
+        class SendWorkflow < CommandTower::Workflows::ApplicationWorkflow
+          retry_strategy :none
+
+          def call(current_user:)
+            send_result = CommandTower::Services::Auth::EmailVerification::Send.call(user: current_user)
+
+            unless send_result.success?
+              return failure(
+                errors: send_result.errors,
+                http_status: IdentityErrorStatus.http_status_for(send_result.errors.first)
+              )
+            end
+
+            message = send_result.data[:message]
+            success(
+              payload: CommandTower::Serializers::Auth::EmailVerification::MessageResponseSerializer.serialize(
+                message: message
+              ),
+              http_status: message.include?("already verified") ? :ok : :created
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/auth/email_verification/verify_workflow.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Auth
+      module EmailVerification
+        class VerifyWorkflow < CommandTower::Workflows::ApplicationWorkflow
+          retry_strategy :none
+
+          def call(current_user:, input:)
+            verify_result = CommandTower::Services::Auth::EmailVerification::Verify.call(
+              user: current_user,
+              code: input.code
+            )
+
+            unless verify_result.success?
+              return failure(
+                errors: verify_result.errors,
+                http_status: IdentityErrorStatus.http_status_for(verify_result.errors.first)
+              )
+            end
+
+            message = verify_result.data[:message]
+            success(
+              payload: CommandTower::Serializers::Auth::EmailVerification::MessageResponseSerializer.serialize(
+                message: message
+              ),
+              http_status: message.include?("already verified") ? :ok : :created
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/auth/identity_error_status.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Auth
+      # HTTP status mapping for the identity lifecycle cluster: email verification,
+      # password recovery sessions, and password reset. Session authentication
+      # statuses live in SessionErrorStatus; signup statuses in SignupErrorStatus.
+      module IdentityErrorStatus
+        module_function
+
+        def http_status_for(error)
+          case error
+          when CommandTower::Errors::Auth::PasswordRecoverySessionMissingError,
+               CommandTower::Errors::Auth::PasswordRecoverySessionInvalidError,
+               CommandTower::Errors::Auth::PasswordRecoverySessionExpiredError,
+               CommandTower::Errors::Auth::PasswordResetInvalidTokenError
+            :unauthorized
+          when CommandTower::Errors::Auth::PasswordRecoverySessionRateLimitError,
+               CommandTower::Errors::Auth::PasswordRecoveryIpRateLimitError
+            :too_many_requests
+          when CommandTower::Errors::Auth::VerificationCodeInvalidError,
+               CommandTower::Errors::ValidationError
+            :unprocessable_entity
+          when CommandTower::Errors::Auth::PasswordResetUnavailableError
+            :service_unavailable
+          when CommandTower::Errors::Auth::VerificationSendFailedError
+            :bad_gateway
+          else
+            :internal_server_error
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/auth/identity_policy_workflow.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Auth
+      class IdentityPolicyWorkflow < CommandTower::Workflows::ApplicationWorkflow
+        retry_strategy :none
+
+        def call
+          policy_result = CommandTower::Services::Auth::IdentityPolicy.call
+
+          unless policy_result.success?
+            return failure(errors: policy_result.errors, http_status: :internal_server_error)
+          end
+
+          success(
+            payload: CommandTower::Serializers::Auth::IdentityPolicySerializer.serialize(
+              policy: policy_result.data[:policy]
+            ),
+            http_status: :ok
+          )
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/auth/logout_workflow.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Auth
+      class LogoutWorkflow < CommandTower::Workflows::ApplicationWorkflow
+        retry_strategy :none
+
+        def call(input: nil, request_context: nil)
+          success(
+            payload: CommandTower::Serializers::Auth::LogoutResponseSerializer.serialize,
+            http_status: :ok,
+            response_effects: { clear_token: true }
+          )
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/auth/password_recovery_session/authenticate_workflow.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Auth
+      module PasswordRecoverySession
+        class AuthenticateWorkflow < CommandTower::Workflows::ApplicationWorkflow
+          retry_strategy :none
+
+          def call(request:)
+            token_data = CommandTower::PasswordRecovery::AuthorizationHelper.extract_token(request)
+
+            if token_data[:error]
+              return failure(errors: [extraction_error(token_data[:error])], http_status: :unauthorized)
+            end
+
+            client_ip = CommandTower::Services::Auth::ClientIpResolver.call(request: request)
+            validate_result = CommandTower::Services::Auth::PasswordRecoverySession::Validate.call(
+              token: token_data[:token],
+              client_ip: client_ip
+            )
+
+            unless validate_result.success?
+              return failure(
+                errors: validate_result.errors,
+                http_status: IdentityErrorStatus.http_status_for(validate_result.errors.first)
+              )
+            end
+
+            success(
+              payload: { password_recovery_session: validate_result.data[:password_recovery_session] },
+              http_status: :ok
+            )
+          end
+
+          private
+
+          def extraction_error(reason)
+            if reason == :missing
+              CommandTower::Errors::Auth::PasswordRecoverySessionMissingError.new
+            else
+              CommandTower::Errors::Auth::PasswordRecoverySessionInvalidError.new
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/auth/password_recovery_session/create_workflow.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Auth
+      module PasswordRecoverySession
+        class CreateWorkflow < CommandTower::Workflows::ApplicationWorkflow
+          retry_strategy :none
+
+          def call(client_ip:)
+            rate_result = CommandTower::Services::Auth::PasswordRecovery::RateLimits::CheckTokenIssue.call(
+              client_ip: client_ip
+            )
+            unless rate_result.success?
+              return failure(
+                errors: rate_result.errors,
+                http_status: IdentityErrorStatus.http_status_for(rate_result.errors.first)
+              )
+            end
+
+            create_result = CommandTower::Services::Auth::PasswordRecoverySession::Create.call
+            unless create_result.success?
+              return failure(errors: create_result.errors, http_status: :internal_server_error)
+            end
+
+            data = create_result.data
+            success(
+              payload: CommandTower::Serializers::Auth::PasswordRecoverySessionResponseSerializer.serialize(
+                token: data[:token],
+                expires_at: data[:expires_at]
+              ),
+              http_status: :created
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/auth/password_reset/reset_workflow.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Auth
+      module PasswordReset
+        class ResetWorkflow < CommandTower::Workflows::ApplicationWorkflow
+          retry_strategy :none
+
+          def call(input:)
+            unless CommandTower.config.login.plain_text.password_reset.enabled
+              error = CommandTower::Errors::Auth::PasswordResetUnavailableError.new
+              return failure(errors: [error], http_status: IdentityErrorStatus.http_status_for(error))
+            end
+
+            reset_result = CommandTower::Services::Auth::PasswordReset::Reset.call(
+              token: input.token,
+              password: input.password,
+              password_confirmation: input.password_confirmation,
+              email: input.email
+            )
+            unless reset_result.success?
+              return failure(
+                errors: reset_result.errors,
+                http_status: IdentityErrorStatus.http_status_for(reset_result.errors.first)
+              )
+            end
+
+            success(
+              payload: CommandTower::Serializers::Auth::PasswordReset::MessageResponseSerializer.serialize(
+                message: reset_result.data[:message]
+              ),
+              http_status: :ok
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/auth/password_reset/send_workflow.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Auth
+      module PasswordReset
+        class SendWorkflow < CommandTower::Workflows::ApplicationWorkflow
+          retry_strategy :none
+
+          def call(input:, password_recovery_session:)
+            unless CommandTower.config.login.plain_text.password_reset.enabled
+              error = CommandTower::Errors::Auth::PasswordResetUnavailableError.new
+              return failure(errors: [error], http_status: IdentityErrorStatus.http_status_for(error))
+            end
+
+            rate_result = CommandTower::Services::Auth::PasswordRecovery::RateLimits::CheckSend.call(
+              password_recovery_session: password_recovery_session
+            )
+            unless rate_result.success?
+              return failure(
+                errors: rate_result.errors,
+                http_status: IdentityErrorStatus.http_status_for(rate_result.errors.first)
+              )
+            end
+
+            send_result = CommandTower::Services::Auth::PasswordReset::Send.call(email: input.email)
+            unless send_result.success?
+              return failure(
+                errors: send_result.errors,
+                http_status: IdentityErrorStatus.http_status_for(send_result.errors.first)
+              )
+            end
+
+            success(
+              payload: CommandTower::Serializers::Auth::PasswordReset::MessageResponseSerializer.serialize(
+                message: send_result.data[:message]
+              ),
+              http_status: :ok
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/auth/password_reset/validate_workflow.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Auth
+      module PasswordReset
+        class ValidateWorkflow < CommandTower::Workflows::ApplicationWorkflow
+          retry_strategy :none
+
+          def call(input:)
+            unless CommandTower.config.login.plain_text.password_reset.enabled
+              error = CommandTower::Errors::Auth::PasswordResetUnavailableError.new
+              return failure(errors: [error], http_status: IdentityErrorStatus.http_status_for(error))
+            end
+
+            validate_result = CommandTower::Services::Auth::PasswordReset::Validate.call(
+              token: input.token,
+              email: input.email
+            )
+            unless validate_result.success?
+              return failure(
+                errors: validate_result.errors,
+                http_status: IdentityErrorStatus.http_status_for(validate_result.errors.first)
+              )
+            end
+
+            data = validate_result.data
+            success(
+              payload: CommandTower::Serializers::Auth::PasswordReset::ValidateResponseSerializer.serialize(
+                valid: data[:valid],
+                expires_at: data[:expires_at]
+              ),
+              http_status: :ok
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/auth/plain_text/login_workflow.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Auth
+      module PlainText
+        class LoginWorkflow < CommandTower::Workflows::ApplicationWorkflow
+          retry_strategy :none
+
+          def call(input:, request_context: nil)
+            login_result = CommandTower::Services::Auth::PlainText::Login.call(
+              identifier: input.identifier,
+              password: input.password
+            )
+
+            if login_result.success?
+              data = login_result.data
+              return success(
+                payload: CommandTower::Serializers::Auth::LoginResponseSerializer.serialize(
+                  user: data[:user],
+                  token: data[:token],
+                  token_expires_at: data[:expires_at]
+                ),
+                http_status: :created,
+                response_effects: {
+                  set_token: { token: data[:token], expires_at: data[:expires_at] },
+                  ensure_csrf_cookie: { rotate: csrf_rotate_on_login? }
+                }
+              )
+            end
+
+            failure(errors: login_result.errors, http_status: :unauthorized)
+          end
+
+          private
+
+          def csrf_rotate_on_login?
+            return false unless CommandTower::Jwt::CsrfHelper.csrf_enabled?
+
+            CommandTower.config.jwt.cookie.csrf.rotate_on_login
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/auth/register_workflow.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Auth
+      class RegisterWorkflow < CommandTower::Workflows::ApplicationWorkflow
+        retry_strategy :none
+
+        def call(input:, client_ip:)
+          rate_result = CommandTower::Services::Auth::SignupRateLimits::CheckRegister.call(client_ip: client_ip)
+          unless rate_result.success?
+            return failure(
+              errors: rate_result.errors,
+              http_status: SignupErrorStatus.http_status_for(rate_result.errors.first)
+            )
+          end
+
+          register_result = CommandTower::Services::Auth::Register.call(
+            first_name: input.first_name,
+            last_name: input.last_name,
+            username: input.username,
+            email: input.email,
+            password: input.password,
+            password_confirmation: input.password_confirmation
+          )
+
+          unless register_result.success?
+            return failure(
+              errors: register_result.errors,
+              http_status: SignupErrorStatus.http_status_for(register_result.errors.first)
+            )
+          end
+
+          user = register_result.data[:user]
+          emit_welcome(user)
+
+          success(
+            payload: CommandTower::Serializers::Auth::RegisterResponseSerializer.serialize(
+              user: user
+            ),
+            http_status: :created
+          )
+        end
+
+        private
+
+        # Synchronous Produce so InboxItem exists before HTTP 201.
+        # Soft-fail: registration already committed the user.
+        def emit_welcome(user)
+          content = CommandTower.config.messaging.welcome_content.call
+          return if content.blank?
+
+          content = content.with_indifferent_access
+          result = CommandTower::Services::Messaging::Communications::Produce.call(
+            user:,
+            notification_type_key: content.fetch(:notification_type_key),
+            host_event_identity: "user_welcome/#{user.id}",
+            title: content.fetch(:title),
+            body: content.fetch(:body),
+            metadata: content[:metadata],
+            platform_enabled_channels: CommandTower::Services::Messaging::Preferences::PlatformEnabledChannels.call,
+          )
+          return if result.success?
+
+          log_welcome_failure(user, result.errors.first)
+        rescue StandardError => error
+          log_welcome_failure(user, error)
+        end
+
+        def log_welcome_failure(user, error)
+          payload = {
+            event: "messaging.welcome_produce_failed",
+            user_id: user.id,
+            error_class: error.class.name,
+          }
+          payload[:error_code] = error.code if error.respond_to?(:code)
+          payload[:error_message] = error.message if error.respond_to?(:message)
+          Rails.logger.error(payload.to_json)
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/auth/session/show_workflow.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Auth
+      module Session
+        class ShowWorkflow < CommandTower::Workflows::ApplicationWorkflow
+          retry_strategy :none
+
+          def call(current_user:, auth_context:)
+            response_effects = {
+              set_expire_header: auth_context.token_expires_at
+            }
+
+            if auth_context.generated_token.present?
+              response_effects[:set_token] = {
+                token: auth_context.generated_token,
+                expires_at: auth_context.token_expires_at
+              }
+              response_effects[:ensure_csrf_cookie] = { rotate: csrf_rotate_on_reset? }
+            end
+
+            success(
+              payload: CommandTower::Serializers::Auth::SessionResponseSerializer.serialize(
+                user: current_user,
+                token_expires_at: auth_context.token_expires_at
+              ),
+              http_status: :ok,
+              response_effects: response_effects
+            )
+          end
+
+          private
+
+          def csrf_rotate_on_reset?
+            return false unless CommandTower::Jwt::CsrfHelper.csrf_enabled?
+
+            CommandTower.config.jwt.cookie.csrf.rotate_on_reset
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/auth/session_error_status.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Auth
+      # HTTP status mapping for session authentication and authorization failures
+      # only. Scoped deliberately narrow, same rationale as SignupErrorStatus: a
+      # platform-wide table would let unrelated products inherit these choices.
+      module SessionErrorStatus
+        module_function
+
+        def http_status_for(error)
+          case error
+          when CommandTower::Errors::Auth::EmailVerificationRequiredError
+            :precondition_failed
+          when CommandTower::Errors::Auth::CsrfMissingError,
+               CommandTower::Errors::Auth::CsrfMismatchError,
+               CommandTower::Errors::ForbiddenError
+            :forbidden
+          when CommandTower::Errors::Auth::InvalidCredentialsError,
+               CommandTower::Errors::UnauthorizedError
+            :unauthorized
+          else
+            :internal_server_error
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/auth/signup_error_status.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Auth
+      # Shared HTTP status mapping for the signup cluster only. Scoped deliberately
+      # narrow: a platform-wide error mapping table would let unrelated products
+      # silently inherit signup's status choices.
+      module SignupErrorStatus
+        module_function
+
+        def http_status_for(error)
+          case error
+          when CommandTower::Errors::Auth::SignupSessionMissingError,
+               CommandTower::Errors::Auth::SignupSessionInvalidError,
+               CommandTower::Errors::Auth::SignupSessionExpiredError
+            :unauthorized
+          when CommandTower::Errors::Auth::SignupSessionRateLimitError,
+               CommandTower::Errors::Auth::SignupIpRateLimitError
+            :too_many_requests
+          when CommandTower::Errors::Auth::EmailAlreadyRegisteredError,
+               CommandTower::Errors::ValidationError
+            :unprocessable_entity
+          else
+            :internal_server_error
+          end
+        end
+      end
+    end
+  end
+end