command_tower 0.4.0 → 0.11.0

data/app/controllers/command_tower/application_controller.rb

@@ -2,9 +2,11 @@
 
 module CommandTower
   class ApplicationController < ActionController::API
-    AUTHENTICATION_HEADER = "Authentication"
-    AUTHENTICATION_EXPIRE_HEADER = "X-Authentication-Expire"
-    AUTHENTICATION_WITH_RESET = "X-Authentication-Reset"
+    include CommandTower::Execution::HttpBoundary
+
+    AUTHENTICATION_HEADER = CommandTower::Jwt::AuthorizationHelper::AUTHENTICATION_HEADER
+    AUTHENTICATION_EXPIRE_HEADER = CommandTower::Jwt::AuthorizationHelper::AUTHENTICATION_EXPIRE_HEADER
+    AUTHENTICATION_WITH_RESET = CommandTower::Jwt::AuthorizationHelper::AUTHENTICATION_WITH_RESET
 
     def safe_boolean(value:)
       return nil unless [true, false, "true", "false", "0", "1", 0, 1].include?(value)
@@ -13,30 +15,98 @@ module CommandTower
     end
 
     ###
-    # Authenticate user via the passed in header
-    # AUTHENTICATION_HEADER="Bearer: {token value}"
+    # Authenticate user via the passed in header or cookie
+    # AUTHENTICATION_HEADER="Bearer {token value}" or cookie (if enabled)
     def authenticate_user!(bypass_email_validation: false)
-      raw_token = request.headers[AUTHENTICATION_HEADER]
-      if raw_token.nil?
+      # Extract and validate token (from header or cookie fallback)
+      token_data = CommandTower::Jwt::AuthorizationHelper.extract_token(request)
+      if token_data[:error]
         status = 401
-        schema = CommandTower::Schema::Error::Base.new(status:, message: "Bearer token missing")
+        schema = CommandTower::Schema::Error::Base.new(status:, message: token_data[:message])
         render(json: schema.to_h, status:)
         return false
       end
 
-      token = raw_token.split("Bearer:")[1].strip
-      with_reset = safe_boolean(value: request.headers[AUTHENTICATION_WITH_RESET])
+      token = token_data[:token]
+      token_source = token_data[:source]
+
+      # CSRF validation for cookie-authenticated unsafe requests
+      # Enforcement is centralized here because token_source is only reliably known in this shared filter
+      if csrf_required?(request, token_source)
+        csrf_validation = CommandTower::Jwt::CsrfHelper.validate(request)
+        unless csrf_validation[:valid]
+          status = 403
+          schema = CommandTower::Schema::Error::Base.new(
+            status: status.to_s,
+            message: csrf_validation[:message]  # Stable error code: "csrf_missing" or "csrf_mismatch"
+          )
+          render(json: schema.to_h, status: status)
+          return false
+        end
+      end
+
+      with_reset = CommandTower::Jwt::AuthorizationHelper.get_with_reset_flag(request)
       result = CommandTower::Jwt::AuthenticateUser.(token:, bypass_email_validation:, with_reset:)
       if result.success?
-        @current_user = result.user
-        response.set_header(AUTHENTICATION_EXPIRE_HEADER, result.expires_at)
+        established = CommandTower::Impersonation::EstablishIdentity.call(
+          actor: result.user,
+          impersonation_session_id: result.impersonation_session_id
+        )
+        if established.expired?
+          status = 401
+          schema = CommandTower::Schema::Error::Base.new(
+            status:,
+            message: CommandTower::Errors::Auth::ImpersonationSessionExpiredError.new.message
+          )
+          render(json: schema.to_h, status:)
+          return false
+        end
+
+        @current_user = established.user
         if with_reset
-          response.set_header(AUTHENTICATION_WITH_RESET, result.generated_token)
+          # Use helper to set both headers and cookie (if enabled)
+          CommandTower::Jwt::AuthorizationHelper.set_token(
+            response,
+            result.generated_token,
+            expires_at: result.expires_at
+          )
+
+          # Handle CSRF cookie issuance/rotation for token reset path
+          # CSRF cookie issuance rules:
+          # - rotate_on_reset = true → force rotate (generate new token)
+          # - rotate_on_reset = false → ensure exists only (create if missing, keep if exists)
+          if CommandTower::Jwt::CsrfHelper.csrf_enabled?
+            if CommandTower.config.jwt.cookie.csrf.rotate_on_reset
+              CommandTower::Jwt::CsrfHelper.ensure_cookie(request, response, should_rotate: true)
+            else
+              # Ensure cookie exists (rotate-or-ensure model)
+              CommandTower::Jwt::CsrfHelper.ensure_cookie(request, response, should_rotate: false)
+            end
+          end
+        else
+          # Only set expire header when not resetting
+          response.set_header(AUTHENTICATION_EXPIRE_HEADER, result.expires_at)
         end
         true
       else
-        status = 401
-        schema = CommandTower::Schema::Error::Base.new(status:, message: result.msg)
+        # Check if this is an email validation failure (status 412)
+        if result.status == 412
+          status = 412
+          schema = CommandTower::Schema::Error::EmailValidationRequired.new(
+            status:,
+            message: result.msg,
+            meta: { email_validated: false }
+          )
+          # Do NOT clear cookie for 412 status - user needs to keep cookie to verify email
+        else
+          # If authentication failed and token came from cookie, clear the invalid cookie
+          # Exception: Do not clear cookie for 412 status (email validation required)
+          if token_source == :cookie
+            CommandTower::Jwt::AuthorizationHelper.clear_cookie(response)
+          end
+          status = result.status || 401
+          schema = CommandTower::Schema::Error::Base.new(status:, message: result.msg)
+        end
         render(json: schema.to_h, status:)
         # Must return false so callbacks know to halt propagation
         false
@@ -77,5 +147,17 @@ module CommandTower
     def current_user
       @current_user ||= nil
     end
+
+    private
+
+    def csrf_required?(request, token_source)
+      return false unless CommandTower::Jwt::CsrfHelper.csrf_enabled?
+      # CRITICAL: Check token_source, not cookie presence
+      return false unless token_source == :cookie
+      return false if request.get? || request.head? || request.options?
+
+      # Unsafe methods: POST, PUT, PATCH, DELETE
+      %w[POST PUT PATCH DELETE].include?(request.method)
+    end
   end
 end

data/app/controllers/command_tower/auth/email/availability_controller.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Auth
+    module Email
+      class AvailabilityController < CommandTower::ApplicationController
+        include CommandTower::Auth::SignupSessionBoundary
+
+        before_action :authenticate_signup_session!
+
+        def show
+          deserialized = CommandTower::Deserializers::Auth::EmailAvailabilityDeserializer.call(params)
+          return render_email_deserializer_errors unless deserialized.success?
+
+          result = CommandTower::Workflows::Auth::EmailAvailabilityWorkflow.call(
+            input: deserialized.input,
+            signup_session: current_signup_session
+          )
+          render_application_result(result)
+        end
+
+        private
+
+        def render_email_deserializer_errors
+          render_application_result(
+            CommandTower::Workflows::WorkflowResult.failure(
+              errors: [CommandTower::Errors::ValidationError.new(details: { email: "Email is required" })],
+              http_status: :unprocessable_entity
+            )
+          )
+        end
+      end
+    end
+  end
+end

data/app/controllers/command_tower/auth/email_verification/send_controller.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Auth
+    module EmailVerification
+      class SendController < CommandTower::ApplicationController
+        include CommandTower::Auth::AuthenticationBoundary
+        include CommandTower::Auth::AuthorizationBoundary
+
+        # Requesting a verification code is exactly the action an unverified user
+        # needs, so the email verification precondition is bypassed here.
+        before_action -> { authenticate_request!(bypass_email_validation: true) }
+        before_action :authorize_request!
+
+        def create
+          result = CommandTower::Workflows::Auth::EmailVerification::SendWorkflow.call(
+            current_user: current_user
+          )
+          render_application_result(result)
+        end
+      end
+    end
+  end
+end

data/app/controllers/command_tower/auth/email_verification/verify_controller.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Auth
+    module EmailVerification
+      class VerifyController < CommandTower::ApplicationController
+        include CommandTower::Auth::AuthenticationBoundary
+        include CommandTower::Auth::AuthorizationBoundary
+
+        before_action -> { authenticate_request!(bypass_email_validation: true) }
+        before_action :authorize_request!
+
+        def create
+          deserialized = CommandTower::Deserializers::Auth::EmailVerification::VerifyDeserializer.call(params)
+          return render_verify_deserializer_errors unless deserialized.success?
+
+          result = CommandTower::Workflows::Auth::EmailVerification::VerifyWorkflow.call(
+            current_user: current_user,
+            input: deserialized.input
+          )
+          render_application_result(result)
+        end
+
+        private
+
+        def render_verify_deserializer_errors
+          render_application_result(
+            CommandTower::Workflows::WorkflowResult.failure(
+              errors: [
+                CommandTower::Errors::Auth::VerificationCodeInvalidError.new(
+                  details: { code: "Verification code is required" }
+                )
+              ],
+              http_status: :unprocessable_entity
+            )
+          )
+        end
+      end
+    end
+  end
+end

data/app/controllers/command_tower/auth/identity_policy_controller.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Auth
+    class IdentityPolicyController < CommandTower::ApplicationController
+      include CommandTower::Api::ApplicationResponseRenderer
+
+      def show
+        result = CommandTower::Workflows::Auth::IdentityPolicyWorkflow.call
+        render_application_result(result)
+      end
+    end
+  end
+end

data/app/controllers/command_tower/auth/impersonation_session_controller.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Auth
+    class ImpersonationSessionController < CommandTower::ApplicationController
+      include CommandTower::Auth::AuthenticationBoundary
+      include CommandTower::Api::ApplicationResponseRenderer
+
+      before_action :authenticate_stop_request!
+
+      def destroy
+        result = CommandTower::Workflows::Impersonation::StopWorkflow.call(
+          actor: current_auth_context.actor_user,
+          impersonation_session_id: current_auth_context.impersonation_session_id,
+          token_expires_at: current_auth_context.token_expires_at
+        )
+        render_application_result(result)
+      end
+
+      private
+
+      def authenticate_stop_request!
+        authenticate_request!(overlay_mode: :capture)
+      end
+    end
+  end
+end

data/app/controllers/command_tower/auth/logout_controller.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Auth
+    class LogoutController < CommandTower::ApplicationController
+      include CommandTower::Api::ApplicationResponseRenderer
+
+      def create
+        token_data = CommandTower::Jwt::AuthorizationHelper.extract_token(request)
+        token = token_data[:error] ? nil : token_data[:token]
+        result = CommandTower::Workflows::Auth::LogoutWorkflow.call(token:)
+        render_application_result(result)
+      end
+    end
+  end
+end

data/app/controllers/command_tower/auth/password_recovery_session/create_controller.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Auth
+    module PasswordRecoverySession
+      class CreateController < CommandTower::ApplicationController
+        include CommandTower::Api::ApplicationResponseRenderer
+
+        def create
+          client_ip = CommandTower::Services::Auth::ClientIpResolver.call(request: request)
+          result = CommandTower::Workflows::Auth::PasswordRecoverySession::CreateWorkflow.call(client_ip: client_ip)
+          render_application_result(result)
+        end
+      end
+    end
+  end
+end

data/app/controllers/command_tower/auth/password_reset/reset_controller.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Auth
+    module PasswordReset
+      class ResetController < CommandTower::ApplicationController
+        include CommandTower::Api::ApplicationResponseRenderer
+        include CommandTower::Api::DeserializerFailureDetails
+
+        def create
+          deserialized = CommandTower::Deserializers::Auth::PasswordReset::ResetDeserializer.call(params)
+          return render_reset_deserializer_errors(deserialized) unless deserialized.success?
+
+          result = CommandTower::Workflows::Auth::PasswordReset::ResetWorkflow.call(input: deserialized.input)
+          render_application_result(result)
+        end
+
+        private
+
+        def render_reset_deserializer_errors(deserialized)
+          render_application_result(
+            CommandTower::Workflows::WorkflowResult.failure(
+              errors: [
+                CommandTower::Errors::ValidationError.new(
+                  details: deserializer_failure_details(deserialized)
+                )
+              ],
+              http_status: :unprocessable_entity
+            )
+          )
+        end
+      end
+    end
+  end
+end

data/app/controllers/command_tower/auth/password_reset/send_controller.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Auth
+    module PasswordReset
+      class SendController < CommandTower::ApplicationController
+        include CommandTower::Auth::PasswordRecoverySessionBoundary
+        include CommandTower::Api::DeserializerFailureDetails
+
+        before_action :authenticate_password_recovery_session!
+
+        def create
+          deserialized = CommandTower::Deserializers::Auth::PasswordReset::SendDeserializer.call(params)
+          return render_send_deserializer_errors(deserialized) unless deserialized.success?
+
+          result = CommandTower::Workflows::Auth::PasswordReset::SendWorkflow.call(
+            input: deserialized.input,
+            password_recovery_session: current_password_recovery_session
+          )
+          render_application_result(result)
+        end
+
+        private
+
+        def render_send_deserializer_errors(deserialized)
+          render_application_result(
+            CommandTower::Workflows::WorkflowResult.failure(
+              errors: [
+                CommandTower::Errors::ValidationError.new(
+                  details: deserializer_failure_details(deserialized)
+                )
+              ],
+              http_status: :unprocessable_entity
+            )
+          )
+        end
+      end
+    end
+  end
+end

data/app/controllers/command_tower/auth/password_reset/validate_controller.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Auth
+    module PasswordReset
+      class ValidateController < CommandTower::ApplicationController
+        include CommandTower::Api::ApplicationResponseRenderer
+        include CommandTower::Api::DeserializerFailureDetails
+
+        def create
+          deserialized = CommandTower::Deserializers::Auth::PasswordReset::ValidateDeserializer.call(params)
+          return render_validate_deserializer_errors(deserialized) unless deserialized.success?
+
+          result = CommandTower::Workflows::Auth::PasswordReset::ValidateWorkflow.call(input: deserialized.input)
+          render_application_result(result)
+        end
+
+        private
+
+        def render_validate_deserializer_errors(deserialized)
+          render_application_result(
+            CommandTower::Workflows::WorkflowResult.failure(
+              errors: [
+                CommandTower::Errors::ValidationError.new(
+                  details: deserializer_failure_details(deserialized)
+                )
+              ],
+              http_status: :unprocessable_entity
+            )
+          )
+        end
+      end
+    end
+  end
+end

data/app/controllers/command_tower/auth/plain_text/login_controller.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Auth
+    module PlainText
+      class LoginController < CommandTower::ApplicationController
+        include CommandTower::Api::ApplicationResponseRenderer
+        include CommandTower::Auth::InvalidCredentialsDeserializerRenderer
+
+        def create
+          deserialized = CommandTower::Deserializers::Auth::PlainText::LoginDeserializer.call(params)
+          return render_application_deserializer_errors(deserialized) unless deserialized.success?
+
+          result = CommandTower::Workflows::Auth::PlainText::LoginWorkflow.call(
+            input: deserialized.input
+          )
+          render_application_result(result)
+        end
+      end
+    end
+  end
+end

data/app/controllers/command_tower/auth/principal_capabilities_controller.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Auth
+    class PrincipalCapabilitiesController < CommandTower::ApplicationController
+      include CommandTower::Auth::AuthenticationBoundary
+      include CommandTower::Auth::AuthorizationBoundary
+
+      before_action :authenticate_request!
+      before_action :authorize_request!
+
+      def show
+        render_application_result(
+          CommandTower::Workflows::Auth::PrincipalCapabilities::ShowWorkflow.call(user: current_user)
+        )
+      end
+    end
+  end
+end

data/app/controllers/command_tower/auth/register_controller.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Auth
+    class RegisterController < CommandTower::ApplicationController
+      include CommandTower::Api::ApplicationResponseRenderer
+
+      def create
+        deserialized = CommandTower::Deserializers::Auth::RegisterDeserializer.call(params)
+        return render_register_deserializer_errors unless deserialized.success?
+
+        result = CommandTower::Workflows::Auth::RegisterWorkflow.call(
+          input: deserialized.input,
+          client_ip: CommandTower::Services::Auth::ClientIpResolver.call(request: request)
+        )
+        render_application_result(result)
+      end
+
+      private
+
+      # Collapses per-field deser failures into one message so registration never
+      # discloses which individual fields the caller got wrong.
+      def render_register_deserializer_errors
+        render_application_result(
+          CommandTower::Workflows::WorkflowResult.failure(
+            errors: [CommandTower::Errors::ValidationError.new(details: { base: "Missing required fields" })],
+            http_status: :unprocessable_entity
+          )
+        )
+      end
+    end
+  end
+end

data/app/controllers/command_tower/auth/session_controller.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Auth
+    class SessionController < CommandTower::ApplicationController
+      include CommandTower::Auth::AuthenticationBoundary
+      include CommandTower::Auth::AuthorizationBoundary
+
+      before_action :authenticate_request!
+      before_action :authorize_request!
+
+      def show
+        result = CommandTower::Workflows::Auth::Session::ShowWorkflow.call(
+          current_user: current_user,
+          auth_context: current_auth_context
+        )
+        render_application_result(result)
+      end
+    end
+  end
+end

data/app/controllers/command_tower/auth/signup_session/create_controller.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Auth
+    module SignupSession
+      class CreateController < CommandTower::ApplicationController
+        include CommandTower::Api::ApplicationResponseRenderer
+
+        def create
+          client_ip = CommandTower::Services::Auth::ClientIpResolver.call(request: request)
+          result = CommandTower::Workflows::Auth::SignupSession::CreateWorkflow.call(client_ip: client_ip)
+          render_application_result(result)
+        end
+      end
+    end
+  end
+end

data/app/controllers/command_tower/auth/username/availability_controller.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Auth
+    module Username
+      class AvailabilityController < CommandTower::ApplicationController
+        include CommandTower::Auth::SignupSessionBoundary
+
+        before_action :authenticate_signup_session!
+
+        def show
+          deserialized = CommandTower::Deserializers::Auth::UsernameAvailabilityDeserializer.call(params)
+          return render_username_deserializer_errors unless deserialized.success?
+
+          result = CommandTower::Workflows::Auth::UsernameAvailabilityWorkflow.call(
+            input: deserialized.input,
+            signup_session: current_signup_session
+          )
+          render_application_result(result)
+        end
+
+        private
+
+        def render_username_deserializer_errors
+          render_application_result(
+            CommandTower::Workflows::WorkflowResult.failure(
+              errors: [CommandTower::Errors::ValidationError.new(details: { username: "Username is required" })],
+              http_status: :unprocessable_entity
+            )
+          )
+        end
+      end
+    end
+  end
+end

data/app/controllers/command_tower/me/audit_events_controller.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Me
+    class AuditEventsController < CommandTower::ApplicationController
+      include CommandTower::Auth::AuthenticationBoundary
+      include CommandTower::Auth::AuthorizationBoundary
+
+      before_action :authenticate_request!
+      before_action :authorize_request!
+
+      def index
+        deserialized = CommandTower::Deserializers::Audit::Events::UserListDeserializer.call(params)
+        return render_deserializer_errors unless deserialized.success?
+
+        render_application_result(
+          CommandTower::Workflows::Audit::Events::ListForUserWorkflow.call(
+            user: current_user,
+            limit: deserialized.input.limit,
+            offset: deserialized.input.offset,
+            actions: deserialized.input.actions,
+            occurred_after: deserialized.input.occurred_after,
+            occurred_before: deserialized.input.occurred_before,
+            subject_types: deserialized.input.subject_types
+          )
+        )
+      end
+
+      def show
+        deserialized = CommandTower::Deserializers::Audit::Events::ShowDeserializer.call(params)
+        return render_deserializer_errors unless deserialized.success?
+
+        render_application_result(
+          CommandTower::Workflows::Audit::Events::ShowForUserWorkflow.call(
+            user: current_user,
+            id: deserialized.input.id
+          )
+        )
+      end
+
+      def filter_options
+        render_application_result(
+          CommandTower::Workflows::Audit::Events::FilterOptionsForUserWorkflow.call
+        )
+      end
+
+      private
+
+      def render_deserializer_errors
+        render_application_result(
+          CommandTower::Workflows::WorkflowResult.failure(
+            errors: [CommandTower::Errors::ValidationError.new(details: { base: "Invalid request parameters" })],
+            http_status: :unprocessable_entity
+          )
+        )
+      end
+    end
+  end
+end