command_tower 0.4.0 → 0.11.0

data/app/services/command_tower/services/audit/events.rb

@@ -0,0 +1,199 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Audit
+      module Events
+        class List < CommandTower::Services::ApplicationService
+          VIEWER_SCOPES = %i[user admin].freeze
+
+          validate :viewer_scope, is_one: VIEWER_SCOPES, required: true
+          validate :limit, is_a: Integer, required: true, gte: 1, lte: 100
+          validate :offset, is_a: Integer, required: true, gt: -1
+          validate :affected_user_id, is_a: Integer, required: false
+          validate :actor_user_id, is_a: Integer, required: false
+          validate :originating_administrator_id, is_a: Integer, required: false
+          validate :actions, is_a: Array, required: false
+          validate :subject_types, is_a: Array, required: false
+          validate :attribution_mode, is_a: String, required: false
+          validate :occurred_after, is_a: [Time, ActiveSupport::TimeWithZone], required: false
+          validate :occurred_before, is_a: [Time, ActiveSupport::TimeWithZone], required: false
+          validate :principal, is_a: User, required: false
+          validate :scope_context, is_a: [CommandTower::AdminScope::ScopeContext, NilClass], required: false
+
+          def call
+            if user_scope? && affected_user_id.nil?
+              return context.fail!(application_error: CommandTower::Errors::InternalError.new)
+            end
+
+            relation = CommandTower::Audit::Event.order(occurred_at: :desc, id: :desc)
+            relation = apply_viewer_scope(relation)
+            relation = apply_admin_scope(relation)
+            relation = apply_present_filters(relation)
+
+            context.events = relation.limit(limit).offset(offset).to_a
+            context.pagination = { limit:, offset:, total_count: relation.count }
+          end
+
+          private
+
+          def user_scope?
+            viewer_scope == :user
+          end
+
+          def apply_viewer_scope(relation)
+            return relation.where(affected_user_id:, user_history: true) if user_scope?
+
+            relation
+          end
+
+          def apply_admin_scope(relation)
+            return relation unless admin_scope?
+
+            CommandTower::AdminScope::ApplyAuditScoping.call(
+              relation:,
+              scope_context:,
+              principal: principal || scope_context_principal
+            )
+          end
+
+          def admin_scope?
+            viewer_scope == :admin && scope_context.present?
+          end
+
+          def scope_context_principal
+            principal
+          end
+
+          def apply_present_filters(relation)
+            action_list = Array(actions).compact_blank
+            relation = relation.where(action: action_list) if action_list.any?
+            type_list = Array(subject_types).compact_blank
+            relation = relation.where(subject_type: type_list) if type_list.any?
+            relation = relation.where(occurred_at: occurred_after..) if occurred_after
+            relation = relation.where(occurred_at: ..occurred_before) if occurred_before
+            return relation if user_scope?
+
+            relation = relation.where(affected_user_id:) if affected_user_id
+            relation = relation.where(actor_user_id:) if actor_user_id
+            relation = relation.where(originating_administrator_id:) if originating_administrator_id
+            relation = relation.where(attribution_mode:) if attribution_mode.present?
+            relation
+          end
+        end
+
+        class Show < CommandTower::Services::ApplicationService
+          VIEWER_SCOPES = %i[user admin].freeze
+
+          validate :viewer_scope, is_one: VIEWER_SCOPES, required: true
+          validate :id, is_a: Integer, required: true
+          validate :affected_user_id, is_a: Integer, required: false
+          validate :principal, is_a: User, required: false
+          validate :scope_context, is_a: [CommandTower::AdminScope::ScopeContext, NilClass], required: false
+
+          def call
+            if viewer_scope == :user && affected_user_id.nil?
+              return context.fail!(application_error: CommandTower::Errors::InternalError.new)
+            end
+
+            relation = CommandTower::Audit::Event.where(id:)
+            if viewer_scope == :user
+              relation = relation.where(affected_user_id:, user_history: true)
+            elsif scope_context.present?
+              relation = CommandTower::AdminScope::ApplyAuditScoping.call(
+                relation:,
+                scope_context:,
+                principal: principal || scope_context_principal
+              )
+            end
+
+            event = relation.first
+            if event.nil?
+              return context.fail!(application_error: CommandTower::Errors::NotFoundError.new)
+            end
+
+            context.event = event
+          end
+
+          private
+
+          def scope_context_principal
+            principal
+          end
+        end
+
+        class Project < CommandTower::Services::ApplicationService
+          validate :event, is_a: CommandTower::Audit::Event, required: true
+          validate :viewer, is_one: %i[user admin], required: true
+
+          def call
+            changes = duplicate_hash(event.change_set)
+            mask_sensitive_changes!(changes)
+
+            context.projection = {
+              id: event.id,
+              event_name: event.action,
+              event_label: registry_label_for(event.action),
+              occurred_at: event.occurred_at,
+              attribution_mode: event.attribution_mode,
+              actor_user_id: event.actor_user_id,
+              affected_user_id: event.affected_user_id,
+              subject_type: event.subject_type,
+              subject_id: event.subject_id,
+              subject_label: event.subject_label,
+              impersonation_active: event.impersonation_active,
+              originating_administrator_id: event.originating_administrator_id,
+              changes:,
+              metadata: duplicate_hash(event.metadata)
+            }
+          end
+
+          private
+
+          def registry_label_for(action)
+            registry = CommandTower.config.registry.audit
+            return "" unless registry.registered?(action)
+
+            registry.fetch(action).label.to_s
+          end
+
+          def mask_sensitive_changes!(changes)
+            sensitivity_keys.each do |key|
+              entry = changes[key] || changes[key.to_sym]
+              next unless entry.is_a?(Hash)
+
+              changes.delete(key)
+              changes.delete(key.to_sym)
+              changes[key] = {
+                "from" => CommandTower::Audit::Masking.value(field: key, raw: hash_value(entry, "from")),
+                "to" => CommandTower::Audit::Masking.value(field: key, raw: hash_value(entry, "to"))
+              }
+            end
+          end
+
+          def sensitivity_keys
+            snapshot = Array(event.sensitive_fields).map(&:to_s)
+            snapshot | current_sensitive_fields
+          end
+
+          def current_sensitive_fields
+            registry = CommandTower.config.registry.audit
+            return [] unless registry.registered?(event.action)
+
+            Array(registry.fetch(event.action).sensitive_fields).map(&:to_s)
+          end
+
+          def duplicate_hash(value)
+            return {} unless value.is_a?(Hash)
+
+            value.deep_dup
+          end
+
+          def hash_value(entry, key)
+            entry[key] || entry[key.to_sym]
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/assign_default_membership_role.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      class AssignDefaultMembershipRole < CommandTower::Services::ApplicationService
+        validate :user, is_a: User, required: true
+
+        def call
+          role_name = CommandTower.config.authorization.default_membership_role
+          if role_name.nil?
+            context.user = user
+            return
+          end
+
+          unless role_present?(role_name)
+            context.fail!(
+              application_error: CommandTower::Errors::Auth::DefaultMembershipAssignmentError.new(
+                details: { role: role_name }
+              )
+            )
+          end
+
+          user.roles = (Array(user.roles) + [role_name.to_s]).uniq
+          unless user.save
+            context.fail!(
+              application_error: CommandTower::Errors::Auth::DefaultMembershipAssignmentError.new(
+                details: user.errors.to_hash
+              )
+            )
+          end
+
+          context.user = user
+        end
+
+        private
+
+        def role_present?(role_name)
+          role_name.to_s.strip.present? && CommandTower::Authorization::Role.roles[role_name].present?
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/authenticate_session.rb

@@ -0,0 +1,132 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      class AuthenticateSession < CommandTower::Services::ApplicationService
+        validate :request_context, is_a: CommandTower::Auth::RequestContext, required: true
+        validate :bypass_email_validation, is_one: [true, false], default: false
+        validate :overlay_mode, is_a: [Symbol, String, NilClass], required: false
+
+        def call
+          request = request_context.request
+          token_data = CommandTower::Jwt::AuthorizationHelper.extract_token(request)
+
+          if token_data[:error]
+            return fail_authentication!(
+              CommandTower::Errors::UnauthorizedError.new,
+              token_source: nil
+            )
+          end
+
+          token = token_data[:token]
+          token_source = token_data[:source]
+
+          if csrf_required?(request, token_source)
+            csrf_validation = CommandTower::Jwt::CsrfHelper.validate(request)
+            unless csrf_validation[:valid]
+              fail_authentication!(
+                csrf_error_for(csrf_validation[:message]),
+                token_source: :cookie
+              )
+              return
+            end
+          end
+
+          with_reset = CommandTower::Jwt::AuthorizationHelper.get_with_reset_flag(request) || false
+          auth_result = CommandTower::Jwt::AuthenticateUser.call(
+            token:,
+            with_reset:,
+            bypass_email_validation:
+          )
+          if auth_result.success?
+            established = CommandTower::Impersonation::EstablishIdentity.call(
+              actor: auth_result.user,
+              impersonation_session_id: auth_result.impersonation_session_id,
+              mode: resolved_overlay_mode
+            )
+            if established.expired?
+              fail_authentication!(
+                CommandTower::Errors::Auth::ImpersonationSessionExpiredError.new,
+                token_source:,
+                impersonation_session_expired: true
+              )
+              return
+            end
+
+            context.user = established.user
+            context.actor_user = established.actor
+            context.impersonation_session_id = auth_result.impersonation_session_id
+            context.token_expires_at = auth_result.expires_at
+            context.generated_token = auth_result.generated_token if with_reset
+            context.service_metadata = observation_metadata(
+              token_source:,
+              authentication_failed: false,
+              cookie_authenticated: token_source == :cookie
+            )
+            return
+          end
+
+          if auth_result.status == 412
+            fail_authentication!(
+              CommandTower::Errors::Auth::EmailVerificationRequiredError.new,
+              token_source:,
+              email_verification_required: true
+            )
+            return
+          end
+
+          fail_authentication!(CommandTower::Errors::UnauthorizedError.new, token_source:)
+        end
+
+        private
+
+        def fail_authentication!(error, token_source:, email_verification_required: false, impersonation_session_expired: false)
+          context.service_metadata = observation_metadata(
+            token_source:,
+            authentication_failed: true,
+            cookie_authenticated: token_source == :cookie,
+            email_verification_required:,
+            impersonation_session_expired:
+          )
+          context.fail!(application_error: error)
+        end
+
+        def observation_metadata(token_source:, authentication_failed:, cookie_authenticated: nil, email_verification_required: false, impersonation_session_expired: false)
+          {
+            token_source:,
+            authentication_mechanism: :jwt,
+            authentication_failed:,
+            cookie_authenticated: cookie_authenticated.nil? ? token_source == :cookie : cookie_authenticated,
+            email_verification_required:,
+            impersonation_session_expired:
+          }
+        end
+
+        def resolved_overlay_mode
+          mode = overlay_mode.nil? ? :enforce : overlay_mode.to_sym
+          %i[enforce capture].include?(mode) ? mode : :enforce
+        end
+
+        def csrf_error_for(message)
+          case message
+          when "csrf_mismatch"
+            CommandTower::Errors::Auth::CsrfMismatchError.new
+          else
+            CommandTower::Errors::Auth::CsrfMissingError.new
+          end
+        end
+
+        # Enforcement lives here because token_source is only reliably known once
+        # the token has been extracted.
+        def csrf_required?(request, token_source)
+          return false unless CommandTower::Jwt::CsrfHelper.csrf_enabled?
+          return false unless token_source == :cookie
+          return false if request.get? || request.head? || request.options?
+
+          %w[POST PUT PATCH DELETE].include?(request.method)
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/authorize_request.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      class AuthorizeRequest < CommandTower::Services::ApplicationService
+        validate :current_user, is_a: User, required: true
+        validate :controller_class, is_a: Class, required: true
+        validate :action_name, is_a: String, required: true
+
+        def call
+          result = CommandTower::Authorize::Validate.call(
+            user: current_user,
+            controller: controller_class,
+            method: action_name
+          )
+
+          context.authorization_required = result.authorization_required
+
+          if result.failure?
+            context.fail!(application_error: CommandTower::Errors::ForbiddenError.new)
+            return
+          end
+
+          # Fail closed: an action the host never mapped into RBAC is not
+          # implicitly public once it sits behind the authorization boundary.
+          unless result.authorization_required
+            context.fail!(application_error: CommandTower::Errors::ForbiddenError.new)
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/client_ip_resolver.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      class ClientIpResolver
+        def self.call(request:)
+          request.remote_ip.to_s
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/email_availability.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      class EmailAvailability < CommandTower::Services::ApplicationService
+        validate :email, is_a: String, required: true, sensitive: true
+
+        def call
+          normalized = email.strip.downcase
+
+          unless valid_format?(normalized)
+            context.valid = false
+            context.available = false
+            context.message = "Enter a valid email address."
+            return
+          end
+
+          if ::User.exists?(email: normalized)
+            context.valid = true
+            context.available = false
+            context.message = "Email is already registered"
+          else
+            context.valid = true
+            context.available = true
+            context.message = "Email is available"
+          end
+        end
+
+        private
+
+        def valid_format?(normalized)
+          return false unless normalized.match?(URI::MailTo::EMAIL_REGEXP)
+
+          plain_text = CommandTower.config.login.plain_text
+          length = normalized.length
+          length > plain_text.email_length_min && length < plain_text.email_length_max
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/email_verification/send.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      module EmailVerification
+        class Send < CommandTower::Services::ApplicationService
+          ALREADY_VERIFIED_MESSAGE = "Email is already verified. No code required"
+          SENT_MESSAGE = "Successfully sent email verification code"
+
+          validate :user, is_a: User, required: true
+
+          def call
+            if user.email_validated
+              context.message = ALREADY_VERIFIED_MESSAGE
+              return
+            end
+
+            secret = issue_code
+            deliver(secret)
+
+            context.message = SENT_MESSAGE
+          end
+
+          private
+
+          def email_verify
+            CommandTower.config.login.plain_text.email_verify
+          end
+
+          def issue_code
+            result = CommandTower::Secrets::Generate.(
+              user:,
+              secret_length: email_verify.verify_code_length,
+              reason: CommandTower::Secrets::EMAIL_VERIFICIATION,
+              use_count_max: 1,
+              death_time: email_verify.verify_code_link_valid_for,
+              type: CommandTower::Secrets::NUMERIC,
+              cleanse: true
+            )
+
+            if result.failure?
+              log_error("Secret Generation is not available at this time for user [#{user.id}]")
+              context.fail!(application_error: CommandTower::Errors::InternalError.new)
+            end
+
+            result.secret
+          end
+
+          def deliver(secret)
+            CommandTower::EmailVerificationMailer.verify_email(
+              user.email,
+              user,
+              secret,
+              template_name: email_verify.custom_template_name
+            ).deliver
+          rescue StandardError => e
+            log_error("Failed to send message to [#{user.id}]: #{e.message}")
+            context.fail!(application_error: CommandTower::Errors::Auth::VerificationSendFailedError.new)
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/email_verification/verify.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      module EmailVerification
+        class Verify < CommandTower::Services::ApplicationService
+          ALREADY_VERIFIED_MESSAGE = "Email is already verified"
+          VERIFIED_MESSAGE = "Successfully verified email"
+          INVALID_CODE_MESSAGE = "Incorrect verification code provided"
+
+          validate :user, is_a: User, required: true
+          validate :code, is_a: String, required: true
+
+          def call
+            if user.email_validated
+              context.message = ALREADY_VERIFIED_MESSAGE
+              return
+            end
+
+            result = CommandTower::Secrets::Verify.(
+              secret: code,
+              reason: CommandTower::Secrets::EMAIL_VERIFICIATION
+            )
+            invalid_code! if result.failure?
+
+            if result.user != user
+              log_warn("Yikes! The logged in user does not match the correct code. Kick them back out and do not verify")
+              invalid_code!
+            end
+
+            user.update(email_validated: true)
+
+            audit(:email_verified, subject: user, affected_user: user, changes: {})
+
+            context.user = user.reload
+            context.message = VERIFIED_MESSAGE
+          end
+
+          private
+
+          def invalid_code!
+            context.fail!(
+              application_error: CommandTower::Errors::Auth::VerificationCodeInvalidError.new(
+                details: { code: INVALID_CODE_MESSAGE }
+              )
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/identity_policy.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      class IdentityPolicy < CommandTower::Services::ApplicationService
+        # Both verification code generators are numeric-only; the platform exposes the
+        # character set so clients can build the right input without guessing.
+        NUMERIC_CHARACTER_SET = "numeric"
+
+        def call
+          plain_text = CommandTower.config.login.plain_text
+          username = CommandTower.config.username
+          email_verify = plain_text.email_verify
+
+          context.policy = {
+            password: exclusive_length_bounds(
+              min: plain_text.password_length_min,
+              max: plain_text.password_length_max
+            ),
+            email: exclusive_length_bounds(
+              min: plain_text.email_length_min,
+              max: plain_text.email_length_max
+            ),
+            username: {
+              min_length: username.username_length_min,
+              max_length: username.username_length_max,
+              pattern: javascript_regex_source(username.username_regex.source),
+              pattern_description: username.username_failure_message
+            },
+            verification_code: {
+              length: email_verify.verify_code_length,
+              character_set: NUMERIC_CHARACTER_SET
+            },
+            phone_verification_code: {
+              length: CommandTower.config.identity.phone_verification.verify_code_length,
+              character_set: NUMERIC_CHARACTER_SET
+            }
+          }
+        end
+
+        private
+
+        def exclusive_length_bounds(min:, max:)
+          {
+            min_length: min + 1,
+            max_length: max - 1
+          }
+        end
+
+        def javascript_regex_source(ruby_source)
+          ruby_source
+            .gsub("\\A", "^")
+            .gsub("\\z", "$")
+            .gsub("\\Z", "$")
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/password_recovery/rate_limits/check_send.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      module PasswordRecovery
+        module RateLimits
+          class CheckSend < CommandTower::Services::ApplicationService
+            include Enforcement
+
+            validate :password_recovery_session,
+              is_a: CommandTower::Auth::PasswordRecoverySessionContext,
+              required: true
+
+            def call
+              remaining = password_recovery_session.remaining_seconds
+              expired_session! if remaining <= 0
+
+              jti_ttl = remaining + CommandTower.config.password_recovery_session.cleanup_buffer_seconds
+
+              enforce!(
+                key: "password-recovery:rate:jti:#{password_recovery_session.jti}:send",
+                ttl_seconds: jti_ttl,
+                limit: limits.jti_send,
+                scope: :session
+              )
+
+              enforce!(
+                key: "password-recovery:rate:ip:#{normalize_ip(password_recovery_session.client_ip)}:send:1h:#{hour_bucket}",
+                ttl_seconds: 3600,
+                limit: limits.ip_send_hour,
+                scope: :ip
+              )
+            end
+
+            private
+
+            def expired_session!
+              context.fail!(
+                application_error: CommandTower::Errors::Auth::PasswordRecoverySessionExpiredError.new
+              )
+            end
+          end
+        end
+      end
+    end
+  end
+end