command_tower 0.4.0 → 0.11.0

data/app/services/command_tower/services/auth/signup_rate_limits/check_availability.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      module SignupRateLimits
+        class CheckAvailability < CommandTower::Services::ApplicationService
+          KINDS = %i[email username].freeze
+
+          include Enforcement
+
+          validate :signup_session, is_a: CommandTower::Auth::SignupSessionContext, required: true
+          validate :kind, is_one: KINDS, required: true
+
+          def call
+            remaining = signup_session.remaining_seconds
+            expired_session! if remaining <= 0
+
+            jti_ttl = remaining + CommandTower.config.signup_session.cleanup_buffer_seconds
+
+            enforce!(
+              key: "signup:rate:jti:#{signup_session.jti}:#{kind}",
+              ttl_seconds: jti_ttl,
+              limit: kind == :email ? limits.jti_email : limits.jti_username,
+              scope: :session
+            )
+
+            enforce!(
+              key: "signup:rate:jti:#{signup_session.jti}:total",
+              ttl_seconds: jti_ttl,
+              limit: limits.jti_total,
+              scope: :session
+            )
+
+            enforce!(
+              key: "signup:rate:ip:#{normalize_ip(signup_session.client_ip)}:availability:1h:#{hour_bucket}",
+              ttl_seconds: 3600,
+              limit: limits.ip_availability_hour,
+              scope: :ip
+            )
+          end
+
+          private
+
+          def expired_session!
+            context.fail!(application_error: CommandTower::Errors::Auth::SignupSessionExpiredError.new)
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/signup_rate_limits/check_register.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      module SignupRateLimits
+        class CheckRegister < CommandTower::Services::ApplicationService
+          include Enforcement
+
+          validate :client_ip, is_a: String, required: true
+
+          def call
+            enforce!(
+              key: "signup:rate:ip:#{normalize_ip(client_ip)}:register:1h:#{hour_bucket}",
+              ttl_seconds: 3600,
+              limit: limits.ip_register_hour,
+              scope: :ip
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/signup_rate_limits/check_token_issue.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      module SignupRateLimits
+        class CheckTokenIssue < CommandTower::Services::ApplicationService
+          include Enforcement
+
+          validate :client_ip, is_a: String, required: true
+
+          def call
+            ip_key = normalize_ip(client_ip)
+
+            enforce!(
+              key: "signup:rate:ip:#{ip_key}:issue:1m:#{minute_bucket}",
+              ttl_seconds: 60,
+              limit: limits.ip_issue_burst,
+              scope: :ip
+            )
+
+            enforce!(
+              key: "signup:rate:ip:#{ip_key}:issue:1h:#{hour_bucket}",
+              ttl_seconds: 3600,
+              limit: limits.ip_issue_hour,
+              scope: :ip
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/signup_rate_limits/enforcement.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      module SignupRateLimits
+        # Counter vocabulary shared by the signup rate limit services. Each
+        # service composes the buckets it cares about; this module owns how a
+        # single bucket is incremented and how a breach is reported.
+        module Enforcement
+          private
+
+          def limits
+            CommandTower.config.signup_session.rate_limits
+          end
+
+          def enforce!(key:, ttl_seconds:, limit:, scope:)
+            result = CommandTower::Services::RateLimits::Check.call(key: key, ttl_seconds: ttl_seconds)
+            context.fail!(application_error: result.errors.first) if result.failure?
+            return if result.data[:count] <= limit
+
+            context.fail!(application_error: rate_limit_error(scope, result.data[:ttl]))
+          end
+
+          def rate_limit_error(scope, ttl)
+            retry_after = ttl.positive? ? ttl : nil
+
+            if scope == :session
+              CommandTower::Errors::Auth::SignupSessionRateLimitError.new(retry_after_seconds: retry_after)
+            else
+              CommandTower::Errors::Auth::SignupIpRateLimitError.new(retry_after_seconds: retry_after)
+            end
+          end
+
+          def minute_bucket
+            Time.now.to_i / 60
+          end
+
+          def hour_bucket
+            Time.now.to_i / 3600
+          end
+
+          def normalize_ip(client_ip)
+            client_ip.to_s
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/signup_session/create.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      module SignupSession
+        class Create < CommandTower::Services::ApplicationService
+          def call
+            jti = SecureRandom.uuid
+            expires_at = CommandTower.config.signup_session.ttl.from_now.utc
+
+            encode_result = Encode.call(jti: jti, expires_at: expires_at)
+            unless encode_result.success?
+              context.fail!(application_error: CommandTower::Errors::InternalError.new)
+              return
+            end
+
+            context.token = encode_result.data[:token]
+            context.expires_at = expires_at
+            context.jti = jti
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/signup_session/decode.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require "jwt"
+
+module CommandTower
+  module Services
+    module Auth
+      module SignupSession
+        class Decode < CommandTower::Services::ApplicationService
+          validate :token, is_a: String, required: true, sensitive: true
+
+          def call
+            data = JWT.decode(
+              token,
+              CommandTower.config.signup_session.jwt_secret,
+              true,
+              { algorithm: "HS256" }
+            )
+            context.payload = data.first.with_indifferent_access
+          rescue JWT::ExpiredSignature
+            context.fail!(application_error: CommandTower::Errors::Auth::SignupSessionExpiredError.new)
+          rescue JWT::DecodeError
+            context.fail!(application_error: CommandTower::Errors::Auth::SignupSessionInvalidError.new)
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/signup_session/encode.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+require "jwt"
+
+module CommandTower
+  module Services
+    module Auth
+      module SignupSession
+        class Encode < CommandTower::Services::ApplicationService
+          validate :jti, is_a: String, required: true
+          validate :expires_at, is_a: Time, required: true
+
+          def call
+            config = CommandTower.config.signup_session
+
+            payload = {
+              iss: config.issuer,
+              aud: config.audience,
+              purpose: config.purpose,
+              jti: jti,
+              iat: Time.now.to_i,
+              exp: expires_at.to_i
+            }
+
+            context.token = JWT.encode(payload, config.jwt_secret, "HS256")
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/signup_session/validate.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      module SignupSession
+        class Validate < CommandTower::Services::ApplicationService
+          validate :token, is_a: String, required: true, sensitive: true
+          validate :client_ip, is_a: String, required: true
+
+          def call
+            decode_result = Decode.call(token: token)
+            unless decode_result.success?
+              context.fail!(application_error: decode_result.errors.first)
+              return
+            end
+
+            payload = decode_result.data[:payload]
+            validation_error = validate_claims(payload)
+            if validation_error
+              context.fail!(application_error: validation_error)
+              return
+            end
+
+            expires_at = Time.at(payload[:exp].to_i).utc
+            if expires_at <= Time.now.utc
+              context.fail!(application_error: CommandTower::Errors::Auth::SignupSessionExpiredError.new)
+              return
+            end
+
+            context.signup_session = CommandTower::Auth::SignupSessionContext.new(
+              jti: payload[:jti].to_s,
+              expires_at: expires_at,
+              client_ip: client_ip
+            )
+          end
+
+          private
+
+          def validate_claims(payload)
+            config = CommandTower.config.signup_session
+
+            return invalid_error if payload[:jti].blank?
+            return invalid_error if payload[:iss] != config.issuer
+            return invalid_error if payload[:aud] != config.audience
+            return invalid_error if payload[:purpose] != config.purpose
+
+            nil
+          end
+
+          def invalid_error
+            CommandTower::Errors::Auth::SignupSessionInvalidError.new
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/username_availability.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      class UsernameAvailability < CommandTower::Services::ApplicationService
+        validate :username, is_a: String, required: true
+
+        def call
+          availability = CommandTower::Username::Available.call(username:, force_query: true)
+
+          context.valid = availability.valid?
+          context.available = availability.available?
+          context.message = availability_message(valid: availability.valid?, available: availability.available?)
+        end
+
+        private
+
+        def availability_message(valid:, available:)
+          return CommandTower.config.username.username_failure_message unless valid
+          return "Username is available" if available
+
+          "Username is already taken"
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/impersonation/create.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Impersonation
+      class Create < CommandTower::Services::ApplicationService
+        validate :actor, is_a: User, required: true
+        validate :target, is_a: User, required: true
+
+        def call
+          now = Time.current
+          idle = CommandTower.config.impersonation.idle_timeout
+          absolute = CommandTower.config.impersonation.absolute_timeout
+
+          session = CommandTower::Impersonation::Session.create!(
+            actor_user_id: actor.id,
+            target_user_id: target.id,
+            started_at: now,
+            last_activity_at: now,
+            idle_expires_at: now + idle,
+            absolute_expires_at: now + absolute
+          )
+
+          context.session = session
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/impersonation/end.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Impersonation
+      class End < CommandTower::Services::ApplicationService
+        validate :session_id, is_a: String, required: true
+        validate :reason, is_a: String, required: true
+        validate :actor_user_id, is_a: Integer, required: false
+
+        def call
+          unless CommandTower::Impersonation::Session::END_REASONS.include?(reason)
+            return context.fail!(application_error: CommandTower::Errors::InternalError.new)
+          end
+
+          now = Time.current
+          relation = CommandTower::Impersonation::Session.open.where(id: session_id)
+          relation = relation.where(actor_user_id:) if actor_user_id
+          updated = relation.update_all(ended_at: now, end_reason: reason, updated_at: now)
+
+          session = CommandTower::Impersonation::Session.find_by(id: session_id)
+          context.session = session
+          context.ended = updated.positive?
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/impersonation/record_activity.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Impersonation
+      class RecordActivity < CommandTower::Services::ApplicationService
+        validate :session_id, is_a: String, required: true
+
+        def call
+          now = Time.current
+          idle = CommandTower.config.impersonation.idle_timeout
+          CommandTower::Impersonation::Session.transaction do
+            session = CommandTower::Impersonation::Session.lock.find_by(id: session_id)
+            if session.nil? || !session.open? || session.expired?(at: now)
+              context.refreshed = false
+              return
+            end
+
+            session.update!(
+              last_activity_at: now,
+              idle_expires_at: now + idle
+            )
+            context.refreshed = true
+            context.session = session
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/impersonation/terminate_open_sessions.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Impersonation
+      class TerminateOpenSessions < CommandTower::Services::ApplicationService
+        validate :actor_user_id, is_a: Integer, required: true
+        validate :reason, is_a: String, required: true
+
+        def call
+          unless CommandTower::Impersonation::Session::END_REASONS.include?(reason)
+            return context.fail!(application_error: CommandTower::Errors::InternalError.new)
+          end
+
+          ids = CommandTower::Impersonation::Session.open.where(actor_user_id:).pluck(:id)
+          ended_count = 0
+          ids.each do |session_id|
+            ended = CommandTower::Services::Impersonation::End.call(
+              session_id:,
+              reason:,
+              actor_user_id:
+            )
+            next unless ended.success? && ended.data[:ended]
+
+            ended_count += 1
+            emit_ended(ended.data[:session], reason:)
+          end
+          context.ended_count = ended_count
+        end
+
+        private
+
+        def emit_ended(session, reason:)
+          target = User.find_by(id: session.target_user_id)
+          return if target.nil?
+
+          CommandTower::Impersonation::ClearOverlayForAudit.call(actor_user_id:) do
+            audit(
+              :impersonation_ended,
+              subject: target,
+              affected_user: target,
+              changes: { reason: { from: nil, to: reason } },
+              metadata: { impersonation_session_id: session.id },
+              attribution_mode: :admin_direct
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/me/capabilities.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Me
+      # Projects which Account self-service actions are enabled for the current user.
+      class Capabilities
+        def self.project(user)
+          new(user).project
+        end
+
+        def initialize(user)
+          @user = user
+        end
+
+        def project
+          {
+            editName: { enabled: true },
+            editUsername: { enabled: false },
+            changeEmail: { enabled: false },
+            changePassword: { enabled: true },
+            editPhone: { enabled: sms_enabled? },
+            editPushover: { enabled: pushover_enabled? },
+            logoutAllDevices: { enabled: false },
+            verifyEmail: { enabled: !user.email_validated }
+          }
+        end
+
+        private
+
+        attr_reader :user
+
+        def sms_enabled?
+          CommandTower::Messaging::ChannelDetectors.sms_product_ready?
+        end
+
+        def pushover_enabled?
+          CommandTower::Messaging::ChannelDetectors.pushover_configured?
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/me/change_password.rb

@@ -0,0 +1,96 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Me
+      class ChangePassword < CommandTower::Services::ApplicationService
+        FIELD_KEYS = {
+          current_password: :currentPassword,
+          password: :password,
+          password_confirmation: :passwordConfirmation
+        }.freeze
+
+        SUCCESS_MESSAGE = "Password has been successfully changed"
+
+        validate :user, is_a: User, required: true
+        validate :current_password, is_a: String, required: true, sensitive: true
+        validate :password, is_a: String, required: true, sensitive: true
+        validate :password_confirmation, is_a: String, required: true, sensitive: true
+
+        def call
+          reject!(current_password: "Incorrect current password") unless user.authenticate(current_password)
+          reject!(password_confirmation: "Password and confirmation do not match") unless password == password_confirmation
+
+          config = CommandTower.config.login.plain_text
+          if password.length < config.password_length_min || password.length > config.password_length_max
+            reject!(
+              password: "Password length must be between #{config.password_length_min} and #{config.password_length_max} characters"
+            )
+          end
+
+          persistence_errors = nil
+          infrastructure_failure = false
+
+          ActiveRecord::Base.transaction do
+            user.password = password
+            user.password_confirmation = password_confirmation
+
+            unless user.save
+              persistence_errors = user.errors.to_hash.transform_values { Array(_1).join(", ") }
+              raise ActiveRecord::Rollback
+            end
+
+            begin
+              user.reset_verifier_token!
+              CommandTower::Services::Impersonation::TerminateOpenSessions.call(
+                actor_user_id: user.id,
+                reason: "revoked"
+              )
+            rescue StandardError => e
+              log_error("Failed to rotate session verifier for user [#{user.id}]: #{e.class}")
+              infrastructure_failure = true
+              raise ActiveRecord::Rollback
+            end
+
+            audit(
+              :password_changed,
+              subject: user,
+              affected_user: user,
+              changes: {},
+              metadata: { mechanism: "authenticated_change" }
+            )
+          end
+
+          if persistence_errors
+            log_error("Failed to update password for user [#{user.id}]")
+            reject!(persistence_errors)
+          end
+
+          if infrastructure_failure
+            context.fail!(application_error: CommandTower::Errors::InternalError.new)
+          end
+
+          # Detect silent rollback (neither branch set) — should not occur in normal paths
+          user.reload
+          unless user.authenticate(password)
+            log_error("Password change transaction did not persist for user [#{user.id}]")
+            context.fail!(application_error: CommandTower::Errors::InternalError.new)
+          end
+
+          log_info("Password changed successfully for user [#{user.id}]")
+          context.message = SUCCESS_MESSAGE
+        end
+
+        private
+
+        def reject!(errors)
+          details = errors.each_with_object({}) do |(key, message), mapped|
+            mapped[FIELD_KEYS.fetch(key.to_sym, key)] = message
+          end
+
+          context.fail!(application_error: CommandTower::Errors::ValidationError.new(details:))
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/me/pushover_product_gate.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Me
+      # Product gate for Pushover-dependent Me/Account endpoint lifecycle HTTP.
+      # Matches host Capabilities::Pushover.enabled? (pushover_configured?).
+      # Does not invent route constraints — callers return 503 when disabled.
+      module PushoverProductGate
+        module_function
+
+        def enabled?
+          CommandTower::Messaging::ChannelDetectors.pushover_configured?
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/me/sms_product_gate.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Me
+      # Product gate for SMS-dependent Me/Account phone lifecycle HTTP.
+      # Matches Me::Capabilities#sms_enabled? / host Capabilities::Sms.enabled?:
+      # Messaging notification SMS configured ∧ Identity OTP SMS ready.
+      # Does not invent route constraints — callers return 503 when disabled.
+      module SmsProductGate
+        module_function
+
+        def enabled?
+          CommandTower::Messaging::ChannelDetectors.sms_product_ready?
+        end
+      end
+    end
+  end
+end