command_tower 0.4.0 → 0.10.0

data/lib/command_tower/configuration/application/config.rb

@@ -21,12 +21,12 @@ module CommandTower
 
         add_composer :url,
           allowed: String,
-          default: ENV.fetch("command_tower_URL", "http://localhost"),
+          default: ENV.fetch("COMMAND_TOWER_FRONTEND_URL", "http://localhost"),
           desc: "When composing SSO's or verification URL's, this is the URL for the application"
 
         add_composer :port,
           allowed: [String, NilClass],
-          default: ENV.fetch("command_tower_PORT", nil),
+          default: ENV.fetch("COMMAND_TOWER_FRONTEND_PORT", nil),
           desc: "When composing SSO's or verification URL's, this is the PORT for the application"
 
         add_composer :composed_url,

data/lib/command_tower/configuration/base.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
 require "class_composer"
-require "pry"
 
 module CommandTower
   module Configuration

data/lib/command_tower/configuration/config.rb

@@ -6,11 +6,17 @@ require "command_tower/configuration/admin/config"
 require "command_tower/configuration/application/config"
 require "command_tower/configuration/authorization/config"
 require "command_tower/configuration/base"
+require "command_tower/configuration/credentials/config"
 require "command_tower/configuration/email/config"
+require "command_tower/configuration/identity/config"
 require "command_tower/configuration/jwt/config"
+require "command_tower/configuration/jwt/cookie/config"
 require "command_tower/configuration/login/config"
+require "command_tower/configuration/messaging/config"
 require "command_tower/configuration/otp/config"
 require "command_tower/configuration/pagination/config"
+require "command_tower/configuration/password_recovery_session/config"
+require "command_tower/configuration/signup_session/config"
 require "command_tower/configuration/user/config"
 require "command_tower/configuration/username/config"
 
@@ -39,6 +45,11 @@ module CommandTower
         allowed: Configuration::Email::Config,
         default: Configuration::Email::Config.new
 
+      add_composer :credentials,
+        desc: "Deployment provider credentials (typed per provider under config.credentials.<provider>). Consumed by Credential Resolution. Not provider behavior configuration.",
+        allowed: Configuration::Credentials::Config,
+        default: Configuration::Credentials::Config.new
+
       add_composer :username,
         desc: "Username configuration for the app",
         allowed: Configuration::Username::Config,
@@ -62,6 +73,16 @@ module CommandTower
         allowed: Configuration::User::Config,
         default: Configuration::User::Config.new
 
+      add_composer :identity,
+        desc: "Identity-owned capabilities (phone verification OTP, etc.)",
+        allowed: Configuration::Identity::Config,
+        default: Configuration::Identity::Config.new
+
+      add_composer :messaging,
+        desc: "Messaging delivery configuration (notification SMS, etc.). Separate from Identity OTP.",
+        allowed: Configuration::Messaging::Config,
+        default: Configuration::Messaging::Config.new
+
       add_composer :admin,
         desc: "Admin configuration for the app",
         allowed: Configuration::Admin::Config,
@@ -72,6 +93,16 @@ module CommandTower
         allowed: Configuration::Pagination::Config,
         default: Configuration::Pagination::Config.new
 
+      add_composer :signup_session,
+        desc: "Signup session token claims, TTL, and signup rate limit ceilings",
+        allowed: Configuration::SignupSession::Config,
+        default: Configuration::SignupSession::Config.new
+
+      add_composer :password_recovery_session,
+        desc: "Password recovery session token claims, TTL, and recovery rate limit ceilings",
+        allowed: Configuration::PasswordRecoverySession::Config,
+        default: Configuration::PasswordRecoverySession::Config.new
+
       # To be Deleted
       add_composer :otp,
         desc: "One Time Password generation is used for ease in quickly validating a users actions. This is good for short term validation requirements as opposed to UserSecrets",
@@ -80,4 +111,3 @@ module CommandTower
     end
   end
 end
-

data/lib/command_tower/configuration/credentials/config.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+require "class_composer"
+require "command_tower/configuration/credentials/twilio"
+require "command_tower/configuration/credentials/smtp"
+
+module CommandTower
+  module Configuration
+    module Credentials
+      # Deployment provider credentials namespace (typed per provider).
+      # Each provider owns its own credential object — no shared generic fields.
+      class Config < ::CommandTower::Configuration::Base
+        include ClassComposer::Generator
+
+        add_composer :twilio,
+          desc: "Twilio deployment credentials (account_sid, auth_token). Typed per provider; consumed by Credential Resolution.",
+          allowed: Twilio,
+          default: Twilio.new
+
+        add_composer :smtp,
+          desc: "SMTP deployment credentials (user_name, password). Typed per provider; consumed by Credential Resolution.",
+          allowed: Smtp,
+          default: Smtp.new
+
+        def inspect
+          "#<#{self.class.name} twilio=[REDACTED] smtp=[REDACTED]>"
+        end
+
+        alias_method :pretty_inspect, :inspect
+      end
+    end
+  end
+end

data/lib/command_tower/configuration/credentials/smtp.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+require "class_composer"
+
+module CommandTower
+  module Configuration
+    module Credentials
+      # Explicit SMTP deployment credentials (config.credentials.smtp).
+      # Consumed by CredentialResolution — not provider behavior configuration.
+      class Smtp < ::CommandTower::Configuration::Base
+        include ClassComposer::Generator
+
+        add_composer :user_name,
+          desc: "SMTP username. Explicit supply for Credential Resolution under config.credentials.smtp. Also used as Messaging ChannelMailer From when present. Alternatives: custom credential_resolver or GMAIL_USER_NAME ENV.",
+          allowed: String,
+          default: "",
+          default_shown: '""'
+
+        add_composer :password,
+          desc: "SMTP password. Explicit supply for Credential Resolution under config.credentials.smtp. Alternatives: custom credential_resolver or GMAIL_PASSWORD ENV.",
+          allowed: String,
+          default: "",
+          default_shown: '""'
+
+        def inspect
+          "#<#{self.class.name} user_name=[REDACTED] password=[REDACTED]>"
+        end
+
+        alias_method :pretty_inspect, :inspect
+      end
+    end
+  end
+end

data/lib/command_tower/configuration/credentials/twilio.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+require "class_composer"
+
+module CommandTower
+  module Configuration
+    module Credentials
+      # Canonical explicit Twilio deployment credentials (config.credentials.twilio).
+      # Consumed by CredentialResolution — not provider behavior configuration.
+      class Twilio < ::CommandTower::Configuration::Base
+        include ClassComposer::Generator
+
+        add_composer :account_sid,
+          desc: "Twilio Account SID. Canonical explicit supply for Credential Resolution. Prefer this over ENV when setting credentials in CommandTower.configure.",
+          allowed: String,
+          default: "",
+          default_shown: '""'
+
+        add_composer :auth_token,
+          desc: "Twilio Auth Token. Canonical explicit supply for Credential Resolution. Prefer this over ENV when setting credentials in CommandTower.configure.",
+          allowed: String,
+          default: "",
+          default_shown: '""'
+
+        def inspect
+          "#<#{self.class.name} account_sid=[REDACTED] auth_token=[REDACTED]>"
+        end
+
+        alias_method :pretty_inspect, :inspect
+      end
+    end
+  end
+end

data/lib/command_tower/configuration/email/config.rb

@@ -15,20 +15,6 @@ module CommandTower
           Rails.configuration.action_mailer.public_send(:"#{key}=", value)
         end
 
-        add_composer :user_name,
-          desc: "User Name for email. Defaults to ENV['GMAIL_USER_NAME']",
-          allowed: String,
-          default: ENV.fetch("GMAIL_USER_NAME", ""),
-          default_shown: "ENV[\"GMAIL_USER_NAME\"]",
-          &ASSIGNMENT
-
-        add_composer :password,
-          desc: "Password for email. Defaults to ENV['GMAIL_PASSWORD']. For more info on how to get this for GMAIL...https://support.google.com/accounts/answer/185833",
-          allowed: String,
-          default: ENV.fetch("GMAIL_PASSWORD", ""),
-          default_shown: "ENV[\"GMAIL_PASSWORD\"]",
-          &ASSIGNMENT
-
         add_composer :port,
           allowed: Integer,
           default: 587,
@@ -66,16 +52,13 @@ module CommandTower
           default: true,
           &ACTION_MAILER
 
+        # Non-secret Gmail SMTP behavior helper. Credentials: config.credentials.smtp.* or ENV.
         def gmail!(
-          from: ENV["GMAIL_USER_NAME"],
-          password: ENV["GMAIL_PASSWORD"],
           port: 587,
           address: "smtp.gmail.com",
           authentication: "plain",
           enable_starttls_auto: true
         )
-          method(:from=).call(from)
-          method(:password=).call(password)
           method(:port=).call(port)
           method(:address=).call(address)
           method(:authentication=).call(authentication)

data/lib/command_tower/configuration/identity/config.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require "class_composer"
+require "command_tower/configuration/identity/phone_verification"
+
+module CommandTower
+  module Configuration
+    module Identity
+      class Config < ::CommandTower::Configuration::Base
+        include ClassComposer::Generator
+
+        add_composer :phone_verification,
+          desc: "Identity phone verification OTP configuration",
+          allowed: PhoneVerification,
+          default: PhoneVerification.new
+      end
+    end
+  end
+end

data/lib/command_tower/configuration/identity/phone_verification.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require "class_composer"
+
+module CommandTower
+  module Configuration
+    module Identity
+      class PhoneVerification < ::CommandTower::Configuration::Base
+        include ClassComposer::Generator
+
+        # Same validation style as Configuration::Messaging::Sms (ADAPTERS + ClassComposer validator).
+        ADAPTERS = %w[fake log twilio].freeze
+
+        add_composer :enable,
+          desc: "Enable Identity phone verification OTP send/verify",
+          allowed: [FalseClass, TrueClass],
+          default: true
+
+        add_composer :verify_code_length,
+          desc: "Length of the numeric phone verification OTP (Generate + Identity Policy)",
+          allowed: Integer,
+          default: 6,
+          validator: ->(val) { (val <= 10) && (val >= 4) },
+          invalid_message: ->(val) { "Provided #{val}. Value must be between 4 and 10 inclusive." }
+
+        add_composer :verify_code_valid_for,
+          desc: "How long a phone verification OTP remains valid",
+          allowed: ActiveSupport::Duration,
+          default: 10.minutes,
+          validator: ->(val) { val < 60.minutes },
+          invalid_message: ->(val) { "Provided #{val}. Value must be less than #{60.minutes}" }
+
+        add_composer :resend_cooldown,
+          desc: "Minimum time between phone verification OTP sends for the same user",
+          allowed: ActiveSupport::Duration,
+          default: 30.seconds,
+          validator: ->(val) { val >= 0.seconds && val < 60.minutes },
+          invalid_message: ->(val) { "Provided #{val}. Value must be >= 0 and less than #{60.minutes}" }
+
+        add_composer :sms_from,
+          desc: "Sender identity for phone verification SMS (provider-specific)",
+          allowed: [String, NilClass],
+          default: nil
+
+        add_composer :sms_adapter,
+          desc: "SMS transport adapter name: fake | log | twilio",
+          allowed: String,
+          default: "fake",
+          validator: ->(val) { ADAPTERS.include?(val.to_s) },
+          invalid_message: ->(val) { "Provided #{val.inspect}. Allowed: #{ADAPTERS.join(', ')}" }
+      end
+    end
+  end
+end

data/lib/command_tower/configuration/jwt/config.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "command_tower/configuration/jwt/cookie/config"
+
 module CommandTower
   module Configuration
     module Jwt
@@ -16,6 +18,11 @@ module CommandTower
           allowed: String,
           default: ENV.fetch("SECRET_KEY_BASE","Thi$IsASeccretIwi::CH&ang3"),
           default_shown: "ENV.fetch(\"SECRET_KEY_BASE\",\"Thi$IsASeccretIwi::CH&ang3\")"
+
+        add_composer_blocking :cookie,
+          desc: "HttpOnly cookie configuration for JWT token persistence",
+          composer_class: Cookie::Config,
+          enable_attr: :enabled
       end
     end
   end

data/lib/command_tower/configuration/jwt/cookie/config.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+require "command_tower/configuration/jwt/cookie/csrf/config"
+
+module CommandTower
+  module Configuration
+    module Jwt
+      module Cookie
+        class Config < ::CommandTower::Configuration::Base
+          include ClassComposer::Generator
+
+          add_composer :enabled,
+            desc: "Enable HttpOnly cookie support for JWT tokens. When disabled, cookies are never set, read, or refreshed",
+            allowed: [TrueClass, FalseClass],
+            default: false
+
+          add_composer :name,
+            desc: "Name of the JWT cookie",
+            allowed: String,
+            default: "ct_jwt"
+
+          add_composer :same_site,
+            desc: "SameSite attribute for the cookie (:lax, :strict, or :none)",
+            allowed: Symbol,
+            default: :lax
+
+          add_composer :secure,
+            desc: "Secure flag for the cookie (HTTPS only). Defaults to false in development, true in production",
+            allowed: [TrueClass, FalseClass],
+            default: false
+
+          add_composer :httponly,
+            desc: "HttpOnly flag for the cookie (prevents JavaScript access)",
+            allowed: [TrueClass, FalseClass],
+            default: true
+
+          add_composer :path,
+            desc: "Path for the cookie",
+            allowed: String,
+            default: "/"
+
+          add_composer :domain,
+            desc: "Domain for the cookie (nil means host-only)",
+            allowed: [String, NilClass],
+            default: nil
+
+          add_composer :ttl,
+            desc: "Time to live for the cookie (defaults to JWT TTL)",
+            allowed: ActiveSupport::Duration,
+            default: 7.days
+
+          add_composer_blocking :csrf,
+            desc: "Double-submit CSRF protection configuration for cookie-authenticated requests",
+            composer_class: Csrf::Config,
+            enable_attr: :enabled
+
+          def enabled?
+            enabled
+          end
+        end
+      end
+    end
+  end
+end

data/lib/command_tower/configuration/jwt/cookie/csrf/config.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Configuration
+    module Jwt
+      module Cookie
+        module Csrf
+          class Config < ::CommandTower::Configuration::Base
+            include ClassComposer::Generator
+
+            add_composer :enabled,
+              desc: "Enable double-submit CSRF protection for cookie-authenticated requests",
+              allowed: [TrueClass, FalseClass],
+              default: false
+
+            add_composer :cookie_name,
+              desc: "Name of the CSRF token cookie (must NOT be HttpOnly)",
+              allowed: String,
+              default: "ct_csrf"
+
+            add_composer :header_name,
+              desc: "Name of the CSRF token header",
+              allowed: String,
+              default: "X-CSRF-Token"
+
+            add_composer :rotate_on_login,
+              desc: "Rotate CSRF token on login",
+              allowed: [TrueClass, FalseClass],
+              default: true
+
+            add_composer :rotate_on_reset,
+              desc: "Rotate CSRF token when JWT token is reset",
+              allowed: [TrueClass, FalseClass],
+              default: true
+
+            # Note: rotate_on_logout removed - logout always clears CSRF cookie (not configurable)
+
+            # Cookie attributes (default to nil to inherit from JWT cookie settings)
+            add_composer :same_site,
+              desc: "SameSite attribute for CSRF cookie (nil inherits from JWT cookie)",
+              allowed: [Symbol, NilClass],
+              default: nil
+
+            add_composer :secure,
+              desc: "Secure flag for CSRF cookie (nil inherits from JWT cookie)",
+              allowed: [TrueClass, FalseClass, NilClass],
+              default: nil
+
+            add_composer :path,
+              desc: "Path for the CSRF cookie (nil inherits from JWT cookie)",
+              allowed: [String, NilClass],
+              default: nil
+
+            add_composer :domain,
+              desc: "Domain for the CSRF cookie (nil inherits from JWT cookie)",
+              allowed: [String, NilClass],
+              default: nil
+
+            add_composer :ttl,
+              desc: "Time to live for the CSRF cookie",
+              allowed: ActiveSupport::Duration,
+              default: 7.days
+
+            def enabled?
+              enabled
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/command_tower/configuration/login/strategy/plain_text/config.rb

@@ -2,6 +2,7 @@
 
 require "command_tower/configuration/login/strategy/plain_text/lockable"
 require "command_tower/configuration/login/strategy/plain_text/email_verify"
+require "command_tower/configuration/login/strategy/plain_text/password_reset"
 
 module CommandTower
   module Configuration
@@ -26,6 +27,11 @@ module CommandTower
               composer_class: EmailVerify,
               enable_attr: :enable
 
+            add_composer_blocking :password_reset,
+              desc: "Enable and change Password Reset for User/Password Login strategy.",
+              composer_class: PasswordReset,
+              enable_attr: :enabled
+
             add_composer :password_length_max,
               desc: "Max Length for Password",
               allowed: Integer,

data/lib/command_tower/configuration/login/strategy/plain_text/email_verify.rb

@@ -42,6 +42,11 @@ module CommandTower
               default: 6,
               validator: -> (val) { (val <= 10) && (val >= 4) },
               invalid_message: ->(val) { "Provided #{val}. Value must be less than or equal to 10 and greater than or equal to 4." }
+
+            add_composer :custom_template_name,
+              desc: "Custom template name to use for the email verification email. Allows using a different view template without creating a custom mailer class. The template should be located at app/views/command_tower/email_verification_mailer/{template_name}.html.erb. Defaults to 'verify_email'",
+              allowed: [String, NilClass],
+              default: nil
           end
         end
       end

data/lib/command_tower/configuration/login/strategy/plain_text/password_reset.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Configuration
+    module Login
+      module Strategy
+        module PlainText
+          class PasswordReset < ::CommandTower::Configuration::Base
+            include ClassComposer::Generator
+
+            add_composer :enabled,
+              desc: "Password reset feature allows users to request password reset via email. By default this is enabled",
+              allowed: [FalseClass, TrueClass],
+              default: true
+
+            add_composer :token_valid_for,
+              desc: "When the password reset token is sent, how long will that token be valid for. By default, this is set to 1 hour",
+              allowed: ActiveSupport::Duration,
+              default: 10.minutes,
+              validator: -> (val) { val < 24.hours },
+              invalid_message: ->(val) { "Provided #{val}. Value must be less than #{24.hours}" }
+
+            add_composer :token_length,
+              desc: "The length of the password reset token sent via email.",
+              allowed: Integer,
+              default: 32,
+              validator: -> (val) { (val <= 64) && (val >= 16) },
+              invalid_message: ->(val) { "Provided #{val}. Value must be less than or equal to 64 and greater than or equal to 16." }
+
+            add_composer :custom_template_name,
+              desc: "Custom template name to use for the password reset email. Allows using a different view template without creating a custom mailer class. The template should be located at app/views/command_tower/password_reset_mailer/{template_name}.html.erb. Defaults to 'reset_password'",
+              allowed: [String, NilClass],
+              default: nil
+
+            add_composer :require_email,
+              desc: "When enabled, requires users to provide both token and email when validating or resetting password. This adds an additional security layer to prevent brute force attacks. Defaults to false for backward compatibility.",
+              allowed: [FalseClass, TrueClass],
+              default: false
+
+            add_composer :reset_password_path,
+              desc: "The path (not full URL) to the frontend reset password page. This path will be appended to CommandTower.config.app.composed_url to form the full URL. Used in email template for the reset link. Defaults to '/reset-password'",
+              allowed: String,
+              default: "/reset-password"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/command_tower/configuration/messaging/config.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+require "class_composer"
+require "command_tower/configuration/messaging/sms"
+require "command_tower/configuration/messaging/pushover"
+
+module CommandTower
+  module Configuration
+    module Messaging
+      class Config < ::CommandTower::Configuration::Base
+        include ClassComposer::Generator
+
+        add_composer :allow_fake_adapter,
+          desc: "Platform testing/development execution override: when true, Execution selects " \
+                "Execution::Adapters::FakeAdapter for any channel. Not provider configuration — " \
+                "intentionally separate from config.messaging.sms.adapter / pushover.adapter. " \
+                "Default false (fail-closed). Precedence: injected executor → this flag → " \
+                "normal provider adapter selection.",
+          allowed: [TrueClass, FalseClass],
+          default: false
+
+        add_composer :platform_enabled_channels,
+          desc: "Host-owned callable returning the Array of channel keys currently enabled for " \
+                "this platform (Preferences HTTP, Accept/Planner injection). CommandTower does " \
+                "not invent product enablement; hosts assign a Proc (e.g. wrapping " \
+                "PlatformEnabledChannels). Default fail-closed empty list.",
+          allowed: [Proc],
+          default: -> { [] },
+          default_shown: "-> { [] }"
+
+        add_composer :welcome_content,
+          desc: "Host-owned callable returning nil or a Hash of welcome Produce fields " \
+                "({ notification_type_key:, title:, body:, metadata? }). " \
+                "Default nil Proc → RegisterWorkflow skips welcome emit. " \
+                "CommandTower does not own product welcome copy.",
+          allowed: [Proc],
+          default: -> { nil },
+          default_shown: "-> { nil }"
+
+        add_composer :resolve_announcement_audience,
+          desc: "Host-owned callable receiving a selection Hash ({ mode:, ids? }) and returning " \
+                "an Array of Integer user ids for ProduceMany. Default empty list (fail-closed). " \
+                "CommandTower never runs product audience queries.",
+          allowed: [Proc],
+          default: ->(_selection) { [] },
+          default_shown: "->(_selection) { [] }"
+
+        add_composer :sms,
+          desc: "Messaging notification SMS delivery configuration (not Identity OTP)",
+          allowed: Sms,
+          default: Sms.new
+
+        add_composer :pushover,
+          desc: "Pushover verification transport configuration (credential validate + test notification)",
+          allowed: Pushover,
+          default: Pushover.new
+      end
+    end
+  end
+end

data/lib/command_tower/configuration/messaging/pushover.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+require "class_composer"
+
+module CommandTower
+  module Configuration
+    module Messaging
+      class Pushover < ::CommandTower::Configuration::Base
+        include ClassComposer::Generator
+
+        ADAPTERS = %w[disabled fake log http].freeze
+
+        add_composer :adapter,
+          desc: "Pushover verification transport: disabled | fake | log | http. Default disabled (fail closed).",
+          allowed: String,
+          default: "disabled",
+          validator: ->(val) { ADAPTERS.include?(val.to_s) },
+          invalid_message: ->(val) { "Provided #{val.inspect}. Allowed: #{ADAPTERS.join(', ')}" }
+
+        add_composer :api_base_url,
+          desc: "Pushover API base URL (versioned path included).",
+          allowed: String,
+          default: "https://api.pushover.net/1"
+
+        add_composer :timeout_seconds,
+          desc: "HTTP open/read timeout seconds for Pushover provider calls.",
+          allowed: Integer,
+          default: 5
+
+        add_composer :test_title,
+          desc: "Title for Pushover verification/test notification. Neutral default; hosts override product copy.",
+          allowed: String,
+          default: "Pushover verification"
+
+        add_composer :test_message,
+          desc: "Body for Pushover verification/test notification.",
+          allowed: String,
+          default: "Your Pushover credentials were verified successfully."
+      end
+    end
+  end
+end