command_tower 0.4.0 → 0.10.0

data/app/controllers/concerns/command_tower/auth/authentication_boundary.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Auth
+    module AuthenticationBoundary
+      extend ActiveSupport::Concern
+
+      included do
+        include CommandTower::Api::ApplicationResponseRenderer
+
+        attr_reader :current_user, :current_auth_context
+      end
+
+      private
+
+      def authenticate_request!(bypass_email_validation: false)
+        result = CommandTower::Workflows::Auth::AuthenticateRequestWorkflow.call(
+          request: request,
+          response: response,
+          bypass_email_validation: bypass_email_validation
+        )
+
+        unless result.success?
+          render_application_result(result)
+          return false
+        end
+
+        @current_user = result.payload[:current_user]
+        @current_auth_context = result.payload[:auth_context]
+        true
+      end
+    end
+  end
+end

data/app/controllers/concerns/command_tower/auth/authorization_boundary.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Auth
+    module AuthorizationBoundary
+      extend ActiveSupport::Concern
+
+      private
+
+      def authorize_request!
+        result = CommandTower::Workflows::Auth::AuthorizeRequestWorkflow.call(
+          current_user: current_user,
+          controller_class: self.class,
+          action_name: action_name
+        )
+
+        unless result.success?
+          render_application_result(result)
+          return false
+        end
+
+        true
+      end
+    end
+  end
+end

data/app/controllers/concerns/command_tower/auth/invalid_credentials_deserializer_renderer.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Auth
+    # Auth-only mapping: deserializer failure → InvalidCredentials + 401.
+    # Do not use ApplicationResponseRenderer#render_application_deserializer_failure
+    # (ValidationError + 422) for login.
+    module InvalidCredentialsDeserializerRenderer
+      extend ActiveSupport::Concern
+
+      private
+
+      def render_application_deserializer_errors(_deserialized)
+        render_application_result(
+          CommandTower::Workflows::WorkflowResult.failure(
+            errors: [CommandTower::Errors::Auth::InvalidCredentialsError.new],
+            http_status: :unauthorized
+          )
+        )
+      end
+    end
+  end
+end

data/app/controllers/concerns/command_tower/auth/password_recovery_session_boundary.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Auth
+    module PasswordRecoverySessionBoundary
+      extend ActiveSupport::Concern
+
+      included do
+        include CommandTower::Api::ApplicationResponseRenderer
+
+        attr_reader :current_password_recovery_session
+      end
+
+      private
+
+      def authenticate_password_recovery_session!
+        result = CommandTower::Workflows::Auth::PasswordRecoverySession::AuthenticateWorkflow.call(request: request)
+
+        unless result.success?
+          render_application_result(result)
+          return false
+        end
+
+        @current_password_recovery_session = result.payload[:password_recovery_session]
+        true
+      end
+    end
+  end
+end

data/app/controllers/concerns/command_tower/auth/signup_session_boundary.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Auth
+    module SignupSessionBoundary
+      extend ActiveSupport::Concern
+
+      included do
+        include CommandTower::Api::ApplicationResponseRenderer
+
+        attr_reader :current_signup_session
+      end
+
+      private
+
+      def authenticate_signup_session!
+        result = CommandTower::Workflows::Auth::SignupSession::AuthenticateWorkflow.call(request: request)
+
+        unless result.success?
+          render_application_result(result)
+          return false
+        end
+
+        @current_signup_session = result.payload[:signup_session]
+        true
+      end
+    end
+  end
+end

data/app/deserializers/command_tower/deserializers/admin/messaging/create_announcement_deserializer.rb

@@ -0,0 +1,106 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Deserializers
+    module Admin
+      module Messaging
+        class CreateAnnouncementDeserializer < CommandTower::Deserializers::ApplicationDeserializer
+          Input = Data.define(
+            :title,
+            :body,
+            :notification_type_key,
+            :campaign_identity,
+            :audience,
+            :user_ids,
+            :execution_mode,
+            :metadata
+          )
+
+          ALLOWED_AUDIENCES = %w[user_ids all_users].freeze
+          ALLOWED_EXECUTION_MODES = %w[async sync].freeze
+
+          def call(params)
+            raw = normalize_hash(params)
+            return failure(errors: { base: "invalid_request" }) if raw.nil?
+
+            title = require_non_blank_string(raw, "title")
+            return title if deserializer_result?(title)
+
+            body = require_non_blank_string(raw, "body")
+            return body if deserializer_result?(body)
+
+            notification_type_key = optional_string(raw, "notificationTypeKey") || "promotional_announcement"
+            campaign_identity = require_non_blank_string(raw, "campaignIdentity")
+            return campaign_identity if deserializer_result?(campaign_identity)
+
+            audience = require_non_blank_string(raw, "audience")
+            return audience if deserializer_result?(audience)
+            return failure(errors: { audience: "must be user_ids or all_users" }) unless ALLOWED_AUDIENCES.include?(audience)
+
+            user_ids = Array(raw["userIds"] || raw["user_ids"])
+            if audience == "user_ids"
+              return failure(errors: { userIds: "required when audience is user_ids" }) if user_ids.empty?
+
+              begin
+                user_ids = user_ids.map { |id| Integer(id) }
+              rescue ArgumentError, TypeError
+                return failure(errors: { userIds: "must be integers" })
+              end
+            else
+              user_ids = []
+            end
+
+            execution_mode = optional_string(raw, "executionMode") || "async"
+            return failure(errors: { executionMode: "must be async or sync" }) unless ALLOWED_EXECUTION_MODES.include?(execution_mode)
+
+            metadata = raw["metadata"]
+            return failure(errors: { metadata: "must be an object" }) if !metadata.nil? && !metadata.is_a?(Hash)
+
+            success(
+              Input.new(
+                title:,
+                body:,
+                notification_type_key:,
+                campaign_identity:,
+                audience: audience.to_sym,
+                user_ids:,
+                execution_mode: execution_mode.to_sym,
+                metadata:,
+              )
+            )
+          end
+
+          private
+
+          def normalize_hash(params)
+            hash =
+              if params.respond_to?(:to_unsafe_h)
+                params.to_unsafe_h
+              elsif params.respond_to?(:to_h)
+                params.to_h
+              else
+                return nil
+              end
+
+            hash.transform_keys(&:to_s)
+          end
+
+          def require_non_blank_string(raw, key)
+            value = raw[key] || raw[key.underscore]
+            return failure(errors: { key => "is required" }) if value.nil? || !value.is_a?(String) || value.strip.empty?
+
+            value.strip
+          end
+
+          def optional_string(raw, key)
+            value = raw[key] || raw[key.underscore]
+            return nil if value.nil?
+            return nil unless value.is_a?(String)
+
+            value.strip.presence
+          end
+        end
+      end
+    end
+  end
+end

data/app/deserializers/command_tower/deserializers/application_deserializer.rb

@@ -0,0 +1,148 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Deserializers
+    class ApplicationDeserializer
+      class DeserializerResult
+        attr_reader :input, :errors
+
+        def initialize(success:, input: nil, errors: nil)
+          @success = success
+          @input = input
+          @errors = errors
+        end
+
+        def success?
+          @success
+        end
+
+        def failure?
+          !success?
+        end
+      end
+
+      def self.call(params)
+        new.call(params)
+      end
+
+      def call(_params)
+        raise NotImplementedError
+      end
+
+      protected
+
+      def success(input)
+        DeserializerResult.new(success: true, input: input)
+      end
+
+      def failure(errors:)
+        # Do not use Array(hash) — Kernel#Array converts Hash to pairs.
+        normalized =
+          case errors
+          when Array then errors
+          when nil then []
+          else [errors]
+          end
+        DeserializerResult.new(success: false, errors: normalized)
+      end
+
+      # Returns the coerced value, or a finished DeserializerResult failure.
+      def unwrap(coercion)
+        return failure(errors: coercion.failures) if coercion.failure?
+
+        coercion.value
+      end
+
+      def deserializer_result?(value)
+        value.is_a?(DeserializerResult)
+      end
+
+      def fetch_param(params, *keys)
+        hash = normalize_params(params)
+        keys.each do |key|
+          string_key = key.to_s
+          symbol_key = key.to_sym
+          if hash.key?(string_key)
+            return CoercionResult.ok(hash[string_key])
+          end
+          if hash.key?(symbol_key)
+            return CoercionResult.ok(hash[symbol_key])
+          end
+        end
+        CoercionResult.ok(nil)
+      end
+
+      def require_string(raw, code: "missing_required_fields", field: nil)
+        if raw.nil? || (raw.is_a?(String) && raw.strip.empty?)
+          return CoercionResult.fail(code: code, field: field)
+        end
+        unless raw.is_a?(String)
+          return CoercionResult.fail(code: "invalid_field_types", field: field)
+        end
+
+        CoercionResult.ok(raw.strip)
+      end
+
+      def optional_string(raw, default: nil)
+        return CoercionResult.ok(default) if raw.nil? || (raw.is_a?(String) && raw.strip.empty?)
+        unless raw.is_a?(String)
+          return CoercionResult.fail(code: "invalid_field_types")
+        end
+
+        CoercionResult.ok(raw.strip)
+      end
+
+      def coerce_integer(raw, code: "invalid_integer", field: nil)
+        case raw
+        when Integer
+          CoercionResult.ok(raw)
+        when String
+          stripped = raw.strip
+          return CoercionResult.fail(code: code, field: field) unless /\A-?\d+\z/.match?(stripped)
+
+          CoercionResult.ok(Integer(stripped, 10))
+        when nil
+          CoercionResult.fail(code: code, field: field)
+        else
+          CoercionResult.fail(code: code, field: field)
+        end
+      end
+
+      def require_integer(raw, code: "invalid_integer", field: nil, min: nil, max: nil)
+        result = coerce_integer(raw, code: code, field: field)
+        return result if result.failure?
+
+        value = result.value
+        if !min.nil? && value < min
+          return CoercionResult.fail(code: code, field: field)
+        end
+        if !max.nil? && value > max
+          return CoercionResult.fail(code: code, field: field)
+        end
+
+        CoercionResult.ok(value)
+      end
+
+      def one_of(raw, allowed:, code: "invalid_value", field: nil)
+        value = raw.is_a?(String) ? raw.strip : raw
+        unless allowed.include?(value)
+          return CoercionResult.fail(code: code, field: field)
+        end
+
+        CoercionResult.ok(value)
+      end
+
+      private
+
+      def normalize_params(params)
+        if params.respond_to?(:to_unsafe_h)
+          params.to_unsafe_h
+        elsif params.respond_to?(:to_h)
+          params.to_h
+        else
+          params
+        end
+      end
+    end
+  end
+end

data/app/deserializers/command_tower/deserializers/auth/email_availability_deserializer.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Deserializers
+    module Auth
+      class EmailAvailabilityDeserializer < CommandTower::Deserializers::ApplicationDeserializer
+        Input = Data.define(:email)
+
+        def call(params)
+          email = params[:email].to_s.strip.downcase
+
+          return failure(errors: { message: "missing_email" }) if email.blank?
+
+          success(Input.new(email:))
+        end
+      end
+    end
+  end
+end

data/app/deserializers/command_tower/deserializers/auth/email_verification/verify_deserializer.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Deserializers
+    module Auth
+      module EmailVerification
+        class VerifyDeserializer < CommandTower::Deserializers::ApplicationDeserializer
+          Input = Data.define(:code)
+
+          def call(params)
+            code = params[:code].to_s.strip
+
+            return failure(errors: { message: "missing_code" }) if code.blank?
+
+            success(Input.new(code:))
+          end
+        end
+      end
+    end
+  end
+end

data/app/deserializers/command_tower/deserializers/auth/password_reset/reset_deserializer.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Deserializers
+    module Auth
+      module PasswordReset
+        class ResetDeserializer < CommandTower::Deserializers::ApplicationDeserializer
+          Input = Data.define(:token, :password, :password_confirmation, :email)
+
+          def call(params)
+            token = params[:token].to_s.strip
+            password = params[:password].to_s
+            password_confirmation = params[:passwordConfirmation].to_s.presence || params[:password_confirmation].to_s
+
+            errors = {}
+            errors[:token] = "Token is required" if token.blank?
+            errors[:password] = "Password is required" if password.blank?
+            errors[:passwordConfirmation] = "Password confirmation is required" if password_confirmation.blank?
+
+            return failure(errors:) if errors.any?
+
+            email = params[:email].to_s.strip.downcase
+            email = nil if email.blank?
+
+            success(Input.new(token:, password:, password_confirmation:, email:))
+          end
+        end
+      end
+    end
+  end
+end

data/app/deserializers/command_tower/deserializers/auth/password_reset/send_deserializer.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Deserializers
+    module Auth
+      module PasswordReset
+        class SendDeserializer < CommandTower::Deserializers::ApplicationDeserializer
+          Input = Data.define(:email)
+
+          def call(params)
+            email = params[:email].to_s.strip.downcase
+
+            return failure(errors: { email: "Email is required" }) if email.blank?
+
+            success(Input.new(email:))
+          end
+        end
+      end
+    end
+  end
+end

data/app/deserializers/command_tower/deserializers/auth/password_reset/validate_deserializer.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Deserializers
+    module Auth
+      module PasswordReset
+        class ValidateDeserializer < CommandTower::Deserializers::ApplicationDeserializer
+          Input = Data.define(:token, :email)
+
+          def call(params)
+            token = params[:token].to_s.strip
+            return failure(errors: { token: "Token is required" }) if token.blank?
+
+            email = params[:email].to_s.strip.downcase
+            email = nil if email.blank?
+
+            success(Input.new(token:, email:))
+          end
+        end
+      end
+    end
+  end
+end

data/app/deserializers/command_tower/deserializers/auth/plain_text/login_deserializer.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Deserializers
+    module Auth
+      module PlainText
+        class LoginDeserializer < CommandTower::Deserializers::ApplicationDeserializer
+          Input = Data.define(:identifier, :password)
+
+          def call(params)
+            identifier = params[:identifier].to_s.strip
+            password = params[:password].to_s.strip
+
+            if identifier.blank? || password.blank?
+              return failure(errors: { message: "invalid_credentials" })
+            end
+
+            success(Input.new(identifier:, password:))
+          end
+        end
+      end
+    end
+  end
+end

data/app/deserializers/command_tower/deserializers/auth/register_deserializer.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Deserializers
+    module Auth
+      class RegisterDeserializer < CommandTower::Deserializers::ApplicationDeserializer
+        Input = Data.define(
+          :first_name,
+          :last_name,
+          :username,
+          :email,
+          :password,
+          :password_confirmation
+        )
+
+        def call(params)
+          first_name = params[:first_name].to_s.strip
+          last_name = params[:last_name].to_s.strip
+          username = params[:username].to_s.strip
+          email = params[:email].to_s.strip.downcase
+          password = params[:password].to_s
+          password_confirmation = params[:password_confirmation].to_s
+
+          if [first_name, last_name, username, email, password, password_confirmation].any?(&:blank?)
+            return failure(errors: { message: "missing_required_fields" })
+          end
+
+          success(
+            Input.new(
+              first_name:,
+              last_name:,
+              username:,
+              email:,
+              password:,
+              password_confirmation:
+            )
+          )
+        end
+      end
+    end
+  end
+end

data/app/deserializers/command_tower/deserializers/auth/username_availability_deserializer.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Deserializers
+    module Auth
+      class UsernameAvailabilityDeserializer < CommandTower::Deserializers::ApplicationDeserializer
+        Input = Data.define(:username)
+
+        def call(params)
+          username = params[:username].to_s.strip
+
+          return failure(errors: { message: "missing_username" }) if username.blank?
+
+          success(Input.new(username:))
+        end
+      end
+    end
+  end
+end

data/app/deserializers/command_tower/deserializers/clients/errors.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Deserializers
+    module Clients
+      # Path composition for nested / indexed DeserializationError details.
+      module Errors
+        module_function
+
+        def prefix(error, segment)
+          unless error.is_a?(::CommandTower::Clients::Errors::DeserializationError)
+            raise ::CommandTower::Clients::Errors::ConfigurationError,
+                  "Errors.prefix expects CommandTower::Clients::Errors::DeserializationError"
+          end
+
+          details = error.details.is_a?(Hash) ? error.details.dup : {}
+          details[:path] = compose_path(details[:path], segment)
+
+          ::CommandTower::Clients::Errors::DeserializationError.new(
+            message: error.message,
+            details: details,
+            cause: error.cause || error
+          )
+        end
+
+        def compose_path(current, segment)
+          current = current.to_s
+          segment = segment.to_s
+
+          return segment if current.empty?
+          return current if segment.empty?
+
+          if segment.start_with?("[")
+            "#{segment}.#{current}"
+          elsif current.start_with?("[")
+            "#{segment}#{current}"
+          else
+            "#{segment}.#{current}"
+          end
+        end
+        module_function :compose_path
+      end
+    end
+  end
+end

data/app/deserializers/command_tower/deserializers/clients/missing.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Deserializers
+    module Clients
+      # Sentinel for "key absent from provider payload" — distinct from explicit nil.
+      Missing = Object.new.freeze
+    end
+  end
+end

data/app/deserializers/command_tower/deserializers/clients/payload.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Deserializers
+    module Clients
+      # Payload key extraction that distinguishes absent keys from explicit nil.
+      module Payload
+        module_function
+
+        def fetch(payload, key)
+          unless payload.is_a?(Hash)
+            raise ::CommandTower::Clients::Errors::ConfigurationError,
+                  "Deserializers::Clients::Payload.fetch expects a Hash payload"
+          end
+
+          payload.fetch(key, Missing)
+        end
+      end
+    end
+  end
+end