command_tower 0.4.0 → 0.10.0

data/app/services/command_tower/user_attributes/mutate.rb

@@ -0,0 +1,154 @@
+# frozen_string_literal: true
+
+module CommandTower::UserAttributes
+  # Applies exactly one configuration-allowed account attribute change to a user.
+  #
+  # Used by modern Me profile services. Callers keep their own authorization
+  # boundary; this object only enforces which attributes may change and what
+  # values they accept.
+  class Mutate
+    # Attributes whose accepted values are not derivable from the column type.
+    VALUE_OVERRIDES = {
+      verifier_token: [true, false],
+    }.freeze
+
+    class Outcome
+      attr_reader :user, :attribute, :msg, :invalid_argument_hash
+
+      def self.success(user:, attribute:)
+        new(success: true, user:, attribute:)
+      end
+
+      def self.invalid(user:, errors:)
+        invalid_argument_hash = errors.transform_values { { msg: _1 } }
+        msg = "Invalid arguments: #{errors.map { |key, message| "#{key}: #{message}" }.join(", ")}"
+
+        new(success: false, user:, msg:, invalid_argument_hash:)
+      end
+
+      def initialize(success:, user:, attribute: nil, msg: nil, invalid_argument_hash: {})
+        @success = success
+        @user = user
+        @attribute = attribute
+        @msg = msg
+        @invalid_argument_hash = invalid_argument_hash
+      end
+
+      def success? = @success
+
+      def failure? = !@success
+
+      def invalid_arguments = failure?
+
+      def invalid_argument_keys = invalid_argument_hash.keys
+    end
+
+    class << self
+      def call(user:, admin_user: nil, **attributes)
+        new(user:, admin_user:, attributes:).call
+      end
+
+      # Invoked from lib/command_tower/configuration/user/config.rb whenever the
+      # changeable attribute list is reconfigured.
+      def assign!
+        @change_rules = nil
+      end
+
+      def change_rules
+        @change_rules ||= build_change_rules
+      end
+
+      private
+
+      def build_change_rules
+        configured = CommandTower.config.user.default_attributes_for_change +
+          CommandTower.config.user.additional_attributes_for_change
+
+        configured.uniq.each_with_object({}) do |attribute, rules|
+          metadata = ::User.attribute_to_type_mapping[attribute]
+          next if metadata.nil?
+
+          key = attribute.to_sym
+          allowed_values = VALUE_OVERRIDES[key] || metadata[:allowed_types]
+          rules[key] = allowed_values ? { values: allowed_values } : { types: metadata[:ruby_type] }
+        end
+      end
+    end
+
+    def initialize(user:, attributes:, admin_user: nil)
+      @user = user
+      @admin_user = admin_user
+      @attributes = attributes.symbolize_keys.compact
+    end
+
+    def call
+      changes = attributes.slice(*change_rules.keys)
+      return invalid(modify_attribute: composition_message(changes)) unless changes.size == 1
+
+      attribute, value = changes.first
+
+      type_message = type_message_for(attribute, value)
+      return invalid(attribute => type_message) if type_message
+
+      business_message = business_message_for(attribute, value)
+      return invalid(attribute => business_message) if business_message
+
+      if attribute == :verifier_token
+        user.reset_verifier_token!
+      else
+        user.update!(attribute => value)
+      end
+
+      Outcome.success(user:, attribute:)
+    end
+
+    private
+
+    attr_reader :user, :admin_user, :attributes
+
+    def change_rules = self.class.change_rules
+
+    def composition_message(changes)
+      provided = changes.keys.presence || "none"
+
+      "Exactly one attribute must be provided for change. " \
+        "Provided: #{provided}. Available: #{change_rules.keys}"
+    end
+
+    def type_message_for(attribute, value)
+      rule = change_rules.fetch(attribute)
+
+      if (values = rule[:values])
+        return nil if values.include?(value)
+
+        "Parameter [#{attribute}] must be one of #{values}. Given #{value}"
+      else
+        types = rule[:types]
+        return nil if Array(types).any? { _1 === value }
+
+        "Parameter [#{attribute}] must be of type #{types}. Given #{value.class} [#{value}]"
+      end
+    end
+
+    def business_message_for(attribute, value)
+      case attribute
+      when :email
+        return nil if value =~ URI::MailTo::EMAIL_REGEXP
+
+        "Invalid email address"
+      when :username
+        return nil if CommandTower::Username::Available.(username: value).valid?
+
+        "Username is invalid. #{CommandTower.config.username.username_failure_message}"
+      when :verifier_token
+        return nil if value
+
+        "verifier_token is invalid. Expected [true] when value present"
+      end
+    end
+
+    def invalid(errors)
+      Outcome.invalid(user:, errors:)
+    end
+  end
+end

data/app/services/command_tower/username/available.rb

@@ -1,27 +1,40 @@
 # frozen_string_literal: true
 
 module CommandTower::Username
-  class Available < CommandTower::ServiceBase
-    on_argument_validation :fail_early
-
+  # Realtime username validity + availability lookup backed by the configured
+  # local cache. Shared by registration, admin/self-service attribute changes and
+  # the availability endpoint, so it stays a plain domain object rather than a
+  # capability service.
+  class Available
     REFRESH_KEY = "username.refresh_after"
 
-    validate :username, is_a: String, required: true
-    validate :force_query, is_a: [TrueClass, FalseClass]
+    CACHE_MUTEX = Mutex.new
+
+    Availability = Data.define(:valid, :available) do
+      def valid? = valid
 
-    def initialize(*)
-      super
+      def available? = available
+    end
 
-      @mutex = Mutex.new
+    def self.call(username:, force_query: false)
+      new(username:, force_query:).call
+    end
+
+    def initialize(username:, force_query: false)
+      @username = username
+      @force_query = force_query
     end
 
     def call
       populate_local_cache! if refresh?
 
-      context.available = available?
-      context.valid = valid?
+      Availability.new(valid: valid?, available: available?)
     end
 
+    private
+
+    attr_reader :username, :force_query
+
     def valid?
       return false if username.length < CommandTower.config.username.username_length_min
       return false if username.length > CommandTower.config.username.username_length_max
@@ -36,7 +49,7 @@ module CommandTower::Username
     # this is a very terrible cache design at scale
     # If we can use Redis, a bloom filter would be great
     def populate_local_cache!
-      @mutex.synchronize do
+      CACHE_MUTEX.synchronize do
         values = User.pluck(:username).map { [_1, 1] }.to_h rescue {}
         realtime.local_cache.write_multi(values)
         realtime.local_cache.write(REFRESH_KEY, realtime.local_cache_ttl.from_now)

data/app/views/command_tower/email_verification_mailer/verify_email.html.erb

@@ -1,26 +1,74 @@
-<p>Hello <%= @user.full_name %>!</p>
+<table width="100%" cellpadding="0" cellspacing="0" border="0" style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif; background-color: #f5f7fa; padding: 40px 20px;">
+  <tr>
+    <td align="center">
+      <table width="600" cellpadding="0" cellspacing="0" border="0" style="background-color: #ffffff; border-radius: 12px; box-shadow: 0 4px 6px rgba(0, 0, 0, 0.1); overflow: hidden;">
+        <!-- Header -->
+        <tr>
+          <td style="background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); padding: 40px 30px; text-align: center;">
+            <h1 style="margin: 0; color: #ffffff; font-size: 28px; font-weight: 600; letter-spacing: -0.5px;">
+              Welcome to <%= CommandTower.config.app.communication_name %>!
+            </h1>
+          </td>
+        </tr>
 
-<p>
-  Welcome to <%= CommandTower.config.app.communication_name %>.
-</p>
-<p>
-  Please provide the following verification code to confirm your email address.
-</p>
-<p></p>
-<p></p>
-<p>
-  <h1>
-    <%= @code %>
-  </h1>
-</p>
+        <!-- Content -->
+        <tr>
+          <td style="padding: 40px 30px;">
+            <p style="margin: 0 0 20px 0; color: #4a5568; font-size: 16px; line-height: 1.6;">
+              Hello <strong style="color: #2d3748;"><%= @user.full_name %></strong>,
+            </p>
 
-<p></p>
-<p></p>
+            <p style="margin: 0 0 30px 0; color: #4a5568; font-size: 16px; line-height: 1.6;">
+              Thank you for joining us! To complete your registration and verify your email address, please use the verification code below:
+            </p>
 
-<p>
-  Best wishes, <%= CommandTower.config.app.communication_name %> team
-</p>
-<p></p>
-<p></p>
+            <!-- Verification Code Box -->
+            <table width="100%" cellpadding="0" cellspacing="0" border="0" style="margin: 30px 0;">
+              <tr>
+                <td align="center" style="padding: 30px; background: linear-gradient(135deg, #f6f8fb 0%, #e9ecef 100%); border-radius: 8px; border: 2px dashed #cbd5e0;">
+                  <div style="font-size: 36px; font-weight: 700; letter-spacing: 8px; color: #667eea; font-family: 'Courier New', monospace; text-align: center;">
+                    <%= @code %>
+                  </div>
+                  <p style="margin: 15px 0 0 0; color: #718096; font-size: 12px; text-transform: uppercase; letter-spacing: 1px;">
+                    Verification Code
+                  </p>
+                </td>
+              </tr>
+            </table>
 
-Visit us at <a href="<%= CommandTower.config.app.composed_url %>" target="_blank"><%= CommandTower.config.app.composed_url %></a>
+            <p style="margin: 30px 0 20px 0; color: #718096; font-size: 14px; line-height: 1.6;">
+              <strong style="color: #4a5568;">Important:</strong> This code will expire in <%= CommandTower.config.login.plain_text.email_verify.verify_code_link_valid_for.inspect %>. If you didn't request this code, please ignore this email.
+            </p>
+          </td>
+        </tr>
+
+        <!-- Footer -->
+        <tr>
+          <td style="padding: 30px; background-color: #f7fafc; border-top: 1px solid #e2e8f0;">
+            <p style="margin: 0 0 15px 0; color: #4a5568; font-size: 14px; text-align: center; line-height: 1.6;">
+              Best regards,<br>
+              <strong style="color: #667eea;"><%= CommandTower.config.app.communication_name %> Team</strong>
+            </p>
+
+            <p style="margin: 0; text-align: center;">
+              <a href="<%= CommandTower.config.app.composed_url %>" target="_blank" style="color: #667eea; text-decoration: none; font-size: 14px; font-weight: 500;">
+                Visit <%= CommandTower.config.app.communication_name %>
+              </a>
+            </p>
+          </td>
+        </tr>
+      </table>
+
+      <!-- Bottom Spacing -->
+      <table width="600" cellpadding="0" cellspacing="0" border="0" style="margin-top: 20px;">
+        <tr>
+          <td style="text-align: center; padding: 20px 0;">
+            <p style="margin: 0; color: #a0aec0; font-size: 12px; line-height: 1.5;">
+              This is an automated message. Please do not reply to this email.
+            </p>
+          </td>
+        </tr>
+      </table>
+    </td>
+  </tr>
+</table>

data/app/views/command_tower/messaging/rendering/email.html.erb

@@ -0,0 +1,28 @@
+<table width="100%" cellpadding="0" cellspacing="0" border="0" style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif; background-color: #f4f5f7; padding: 32px 16px;">
+  <tr>
+    <td align="center">
+      <table width="600" cellpadding="0" cellspacing="0" border="0" style="background-color: #ffffff; border: 1px solid #e2e8f0; border-radius: 8px; overflow: hidden;">
+        <tr>
+          <td style="padding: 28px 28px 8px 28px;">
+            <h1 style="margin: 0; color: #1a202c; font-size: 22px; font-weight: 600; line-height: 1.35;">
+              <%= h.call(title) %>
+            </h1>
+          </td>
+        </tr>
+        <tr>
+          <td style="padding: 8px 28px 28px 28px;">
+            <p style="margin: 0; color: #4a5568; font-size: 16px; line-height: 1.6; white-space: pre-wrap;">
+<%= h.call(body) %></p>
+            <% if deep_link -%>
+            <p style="margin: 24px 0 0 0;">
+              <a href="<%= h.call(deep_link) %>" style="color: #2b6cb0; font-size: 14px; text-decoration: underline;">
+                <%= h.call(deep_link) %>
+              </a>
+            </p>
+            <% end -%>
+          </td>
+        </tr>
+      </table>
+    </td>
+  </tr>
+</table>

data/app/views/command_tower/messaging/rendering/email.text.erb

@@ -0,0 +1,7 @@
+<%= title %>
+
+<%= body %>
+<% if deep_link -%>
+
+<%= deep_link %>
+<% end -%>

data/app/views/command_tower/messaging/rendering/pushover.text.erb

@@ -0,0 +1 @@
+<%= body %><% if deep_link %> <%= deep_link %><% end %>

data/app/views/command_tower/messaging/rendering/sms.text.erb

@@ -0,0 +1 @@
+<%= title %>: <%= body %><% if deep_link %> <%= deep_link %><% end %>

data/app/views/command_tower/password_reset_mailer/reset_password.html.erb

@@ -0,0 +1,107 @@
+<table width="100%" cellpadding="0" cellspacing="0" border="0" style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif; background-color: #f5f7fa; padding: 40px 20px;">
+  <tr>
+    <td align="center">
+      <table width="600" cellpadding="0" cellspacing="0" border="0" style="background-color: #ffffff; border-radius: 12px; box-shadow: 0 4px 6px rgba(0, 0, 0, 0.1); overflow: hidden;">
+        <!-- Header -->
+        <tr>
+          <td style="background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); padding: 40px 30px; text-align: center;">
+            <h1 style="margin: 0; color: #ffffff; font-size: 28px; font-weight: 600; letter-spacing: -0.5px;">
+              Reset Your Password
+            </h1>
+          </td>
+        </tr>
+
+        <!-- Content -->
+        <tr>
+          <td style="padding: 40px 30px;">
+            <p style="margin: 0 0 20px 0; color: #4a5568; font-size: 16px; line-height: 1.6;">
+              Hello <strong style="color: #2d3748;"><%= @user.full_name %></strong>,
+            </p>
+
+            <p style="margin: 0 0 30px 0; color: #4a5568; font-size: 16px; line-height: 1.6;">
+              We received a request to reset your password for your <%= CommandTower.config.app.communication_name %> account. Click the button below to reset your password:
+            </p>
+
+            <!-- Reset Token Box -->
+            <table width="100%" cellpadding="0" cellspacing="0" border="0" style="margin: 30px 0;">
+              <tr>
+                <td align="center" style="padding: 30px; background: linear-gradient(135deg, #f6f8fb 0%, #e9ecef 100%); border-radius: 8px; border: 2px dashed #cbd5e0;">
+                  <div style="font-size: 18px; font-weight: 600; color: #667eea; font-family: 'Courier New', monospace; text-align: center; word-break: break-all; padding: 10px;">
+                    <%= @token %>
+                  </div>
+                  <p style="margin: 15px 0 0 0; color: #718096; font-size: 12px; text-transform: uppercase; letter-spacing: 1px;">
+                    Reset Token
+                  </p>
+                </td>
+              </tr>
+            </table>
+
+            <!-- Reset Button -->
+            <table width="100%" cellpadding="0" cellspacing="0" border="0" style="margin: 30px 0;">
+              <tr>
+                <td align="center" style="padding: 15px 0;">
+                  <% reset_url = "#{CommandTower.config.app.composed_url}#{@reset_password_path}?token=#{@token}" %>
+                  <% reset_url += "&email=#{CGI.escape(@email)}" if @require_email %>
+                  <a href="<%= reset_url %>" style="display: inline-block; padding: 14px 32px; background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); color: #ffffff; text-decoration: none; border-radius: 8px; font-weight: 600; font-size: 16px; text-align: center;">
+                    Reset Password
+                  </a>
+                </td>
+              </tr>
+            </table>
+
+            <p style="margin: 30px 0 20px 0; color: #718096; font-size: 14px; line-height: 1.6;">
+              <strong style="color: #4a5568;">Important:</strong> This link will expire in <%= CommandTower.config.login.plain_text.password_reset.token_valid_for.inspect %>. If you didn't request a password reset, please ignore this email. Your password will remain unchanged.
+            </p>
+
+            <p style="margin: 20px 0 0 0; color: #718096; font-size: 14px; line-height: 1.6;">
+              If the button above doesn't work, copy and paste the reset token above into the password reset form on our website.
+            </p>
+
+            <!-- Alternative Reset URL Link -->
+            <table width="100%" cellpadding="0" cellspacing="0" border="0" style="margin: 30px 0 0 0;">
+              <tr>
+                <td align="center" style="padding: 20px; background-color: #f7fafc; border-radius: 8px; border: 1px solid #e2e8f0;">
+                  <p style="margin: 0 0 10px 0; color: #4a5568; font-size: 14px; font-weight: 600;">
+                    Or visit the reset password page directly:
+                  </p>
+                  <p style="margin: 0; color: #667eea; font-size: 14px; word-break: break-all;">
+                    <a href="<%= CommandTower.config.app.composed_url %><%= @reset_password_path %>" style="color: #667eea; text-decoration: underline;">
+                      <%= CommandTower.config.app.composed_url %><%= @reset_password_path %>
+                    </a>
+                  </p>
+                </td>
+              </tr>
+            </table>
+          </td>
+        </tr>
+
+        <!-- Footer -->
+        <tr>
+          <td style="padding: 30px; background-color: #f7fafc; border-top: 1px solid #e2e8f0;">
+            <p style="margin: 0 0 15px 0; color: #4a5568; font-size: 14px; text-align: center; line-height: 1.6;">
+              Best regards,<br>
+              <strong style="color: #667eea;"><%= CommandTower.config.app.communication_name %> Team</strong>
+            </p>
+
+            <p style="margin: 0; text-align: center;">
+              <a href="<%= CommandTower.config.app.composed_url %>" target="_blank" style="color: #667eea; text-decoration: none; font-size: 14px; font-weight: 500;">
+                Visit <%= CommandTower.config.app.communication_name %>
+              </a>
+            </p>
+          </td>
+        </tr>
+      </table>
+
+      <!-- Bottom Spacing -->
+      <table width="600" cellpadding="0" cellspacing="0" border="0" style="margin-top: 20px;">
+        <tr>
+          <td style="text-align: center; padding: 20px 0;">
+            <p style="margin: 0; color: #a0aec0; font-size: 12px; line-height: 1.5;">
+              This is an automated message. Please do not reply to this email.
+            </p>
+          </td>
+        </tr>
+      </table>
+    </td>
+  </tr>
+</table>

data/app/views/layouts/mailer.html.erb

@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
+    <style>
+      /* Email styles need to be inline */
+    </style>
+  </head>
+
+  <body>
+    <%= yield %>
+  </body>
+</html>

data/app/views/layouts/mailer.text.erb

@@ -0,0 +1 @@
+<%= yield %>

data/app/workflows/command_tower/workflows/admin/messaging/create_announcement_workflow.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Admin
+      module Messaging
+        class CreateAnnouncementWorkflow < CommandTower::Workflows::ApplicationWorkflow
+          retry_strategy :none
+
+          def call(input:)
+            user_ids = resolve_user_ids(input)
+            platform_enabled_channels =
+              CommandTower::Services::Messaging::Preferences::PlatformEnabledChannels.call
+
+            result = CommandTower::Services::Messaging::Communications::ProduceMany.call(
+              user_ids:,
+              notification_type_key: input.notification_type_key,
+              campaign_identity: input.campaign_identity,
+              title: input.title,
+              body: input.body,
+              metadata: input.metadata,
+              platform_enabled_channels:,
+              execution_mode: input.execution_mode,
+            )
+
+            unless result.success?
+              return failure(
+                errors: result.errors,
+                http_status: CommandTower::Workflows::Messaging::ErrorMapping.http_status_for(result.errors.first)
+              )
+            end
+
+            success(
+              payload: CommandTower::Serializers::Admin::Messaging::AnnouncementResponseSerializer.serialize(
+                result.data
+              ),
+              http_status: :accepted
+            )
+          end
+
+          private
+
+          def resolve_user_ids(input)
+            selection =
+              case input.audience
+              when :user_ids
+                { mode: :user_ids, ids: input.user_ids }
+              when :all_users
+                { mode: :all_users }
+              else
+                { mode: :none }
+              end
+
+            Array(CommandTower.config.messaging.resolve_announcement_audience.call(selection)).map { |id| Integer(id) }
+          rescue ArgumentError, TypeError
+            []
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/application_workflow.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    class ApplicationWorkflow
+      class << self
+        def call(**args)
+          validate_retry_strategy!
+          begin
+            new.call(**args)
+          rescue StandardError => e
+            log_unknown_exception(e)
+            WorkflowResult.failure(
+              errors: [CommandTower::Errors::InternalError.new(cause: e)],
+              http_status: :internal_server_error
+            )
+          end
+        end
+
+        # Job transport entry: same WorkflowResult as `.call`, but raises when the
+        # workflow marks the failure for ActiveJob propagation (`meta[:propagate_to_job]`).
+        # Controllers continue to use `.call` and render envelopes from WorkflowResult.
+        def call_from_job(**args)
+          result = call(**args)
+          if result.failure? && result.meta[:propagate_to_job]
+            error = Array(result.errors).first
+            raise error if error
+
+            raise StandardError, "#{name} failed for job without errors"
+          end
+
+          result
+        end
+
+        def retry_strategy(strategy)
+          @retry_strategy = strategy
+        end
+
+        def validate_retry_strategy!
+          return if @retry_strategy
+
+          raise "#{name} must declare retry_strategy (:none, :sidekiq, or :scheduled_cadence)"
+        end
+
+        def log_unknown_exception(exception)
+          Rails.logger.error(
+            "[#{name}] Unknown workflow exception: #{exception.class}: #{exception.message}\n" \
+            "#{exception.backtrace&.join("\n")}"
+          )
+        end
+      end
+
+      def call(**)
+        raise NotImplementedError
+      end
+
+      protected
+
+      def success(payload:, http_status: :ok, response_effects: nil, meta: {})
+        WorkflowResult.success(payload:, http_status:, response_effects:, meta:)
+      end
+
+      def failure(errors:, http_status:, response_effects: nil, meta: {})
+        WorkflowResult.failure(errors:, http_status:, response_effects:, meta:)
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/auth/authenticate_request_workflow.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Auth
+      class AuthenticateRequestWorkflow < CommandTower::Workflows::ApplicationWorkflow
+        retry_strategy :none
+
+        def call(request:, response:, bypass_email_validation: false)
+          request_context = CommandTower::Auth::RequestContext.from(request, response)
+          auth_result = CommandTower::Services::Auth::AuthenticateSession.call(
+            request_context: request_context,
+            bypass_email_validation: bypass_email_validation
+          )
+
+          unless auth_result.success?
+            return failure(
+              errors: auth_result.errors,
+              http_status: SessionErrorStatus.http_status_for(auth_result.errors.first),
+              response_effects: AuthenticationResponseEffects.for_auth_failure(auth_result.metadata).presence
+            )
+          end
+
+          auth_context = CommandTower::Auth::AuthContext.from_authenticate_session_result(
+            data: auth_result.data,
+            metadata: auth_result.metadata
+          )
+
+          success(
+            payload: {
+              current_user: auth_context.user,
+              auth_context: auth_context
+            },
+            http_status: :ok
+          )
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/auth/authentication_response_effects.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Auth
+      # Translates authentication observation metadata into transport effects the
+      # renderer applies. Keeps cookie mechanics out of the authentication service.
+      module AuthenticationResponseEffects
+        module_function
+
+        def for_auth_failure(metadata)
+          effects = {}
+          if metadata[:cookie_authenticated] && metadata[:authentication_failed]
+            effects[:clear_auth_cookie] = true
+          end
+          effects
+        end
+      end
+    end
+  end
+end