command_tower 0.4.0 → 0.11.0

data/app/workflows/command_tower/workflows/impersonation/start_workflow.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Impersonation
+      class StartWorkflow < CommandTower::Workflows::ApplicationWorkflow
+        retry_strategy :none
+
+        def call(id:, actor:, scope_value: nil)
+          if CommandTower::Current.impersonation_active
+            return failure(
+              errors: [CommandTower::Errors::Auth::NestedImpersonationError.new],
+              http_status: :forbidden
+            )
+          end
+
+          if actor.id == id
+            return failure(
+              errors: [CommandTower::Errors::Auth::SelfImpersonationError.new],
+              http_status: :unprocessable_entity
+            )
+          end
+
+          scope_result = CommandTower::Workflows::Admin::ScopeResolution.resolve(
+            tool_id: "users",
+            user: actor,
+            scope_value:
+          )
+          return scope_result if scope_result.is_a?(CommandTower::Workflows::WorkflowResult)
+
+          shown = CommandTower::Services::Admin::Users::Show.call(
+            id:,
+            principal: actor,
+            scope_context: scope_result
+          )
+          unless shown.success?
+            return failure(
+              errors: shown.errors,
+              http_status: CommandTower::Workflows::Admin::Users::ErrorMapping.http_status_for(shown.errors.first)
+            )
+          end
+
+          target = shown.data[:user]
+          created = CommandTower::Services::Impersonation::Create.call(actor:, target:)
+          unless created.success?
+            return failure(
+              errors: created.errors,
+              http_status: :internal_server_error
+            )
+          end
+
+          session = created.data[:session]
+          audit_started(session:, target:, scope_context: scope_result)
+
+          token = CommandTower::Jwt::LoginCreate.call(
+            user: actor,
+            impersonation_session_id: session.id
+          ).token
+          expires_at = CommandTower.config.jwt.ttl.from_now.to_time.to_s
+
+          success(
+            payload: CommandTower::Serializers::Impersonation::SessionSerializer.serialize(session),
+            http_status: :created,
+            response_effects: {
+              set_token: { token:, expires_at: }
+            }
+          )
+        end
+
+        private
+
+        def audit_started(session:, target:, scope_context:)
+          scope_class, host_context = audit_scope_for(scope_context)
+          audit(
+            :impersonation_started,
+            subject: target,
+            affected_user: target,
+            metadata: { impersonation_session_id: session.id },
+            attribution_mode: :admin_direct,
+            scope_class:,
+            host_context:
+          )
+        end
+
+        def audit_scope_for(scope_context)
+          return [:global, nil] if scope_context.nil?
+          return [:global, nil] unless CommandTower.config.admin_scope.registered?("users")
+
+          type = CommandTower.config.admin_scope.fetch("users").host_context_type
+          return [:global, nil] if type.to_s.strip.empty?
+
+          [:host, { type:, identifier: scope_context.scope_value }]
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/impersonation/stop_workflow.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Impersonation
+      class StopWorkflow < CommandTower::Workflows::ApplicationWorkflow
+        retry_strategy :none
+
+        def call(actor:, impersonation_session_id:, token_expires_at: nil)
+          session_id = impersonation_session_id.to_s.strip
+          if session_id.empty?
+            return failure(
+              errors: [CommandTower::Errors::Auth::ImpersonationSessionMissingError.new],
+              http_status: :unprocessable_entity
+            )
+          end
+
+          ended = CommandTower::Services::Impersonation::End.call(
+            session_id:,
+            reason: "manual",
+            actor_user_id: actor.id
+          )
+          unless ended.success?
+            return failure(
+              errors: ended.errors,
+              http_status: CommandTower::Workflows::Impersonation::ErrorMapping.http_status_for(ended.errors.first)
+            )
+          end
+
+          session = ended.data[:session]
+          if session.nil? || session.actor_user_id != actor.id
+            return failure(
+              errors: [CommandTower::Errors::Auth::ImpersonationSessionMissingError.new],
+              http_status: :unprocessable_entity
+            )
+          end
+
+          if ended.data[:ended]
+            target = User.find_by(id: session.target_user_id)
+            if target
+              audit(
+                :impersonation_ended,
+                subject: target,
+                affected_user: target,
+                changes: { reason: { from: nil, to: "manual" } },
+                metadata: { impersonation_session_id: session.id },
+                attribution_mode: CommandTower::Current.impersonation_active ? nil : :admin_direct
+              )
+            end
+          end
+
+          token = CommandTower::Jwt::LoginCreate.call(user: actor).token
+          expires_at = token_expires_at.presence || CommandTower.config.jwt.ttl.from_now.to_time.to_s
+
+          success(
+            payload: { message: "impersonation_ended" },
+            http_status: :ok,
+            response_effects: {
+              set_token: { token:, expires_at: }
+            }
+          )
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/me/change_password_workflow.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Me
+      class ChangePasswordWorkflow < CommandTower::Workflows::ApplicationWorkflow
+        retry_strategy :none
+
+        def call(current_user:, current_password:, password:, password_confirmation:)
+          change_result = CommandTower::Services::Me::ChangePassword.call(
+            user: current_user,
+            current_password:,
+            password:,
+            password_confirmation:
+          )
+
+          unless change_result.success?
+            error = change_result.errors.first
+            return failure(
+              errors: change_result.errors,
+              http_status: CommandTower::Workflows::Me::ErrorStatus.http_status_for(error)
+            )
+          end
+
+          success(
+            payload: CommandTower::Serializers::Me::ChangePasswordResponseSerializer.serialize,
+            http_status: :ok,
+            response_effects: { clear_token: true }
+          )
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/me/clear_phone_workflow.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Me
+      class ClearPhoneWorkflow < CommandTower::Workflows::ApplicationWorkflow
+        retry_strategy :none
+
+        def call(current_user:, auth_context: nil)
+          unless CommandTower::Services::Me::SmsProductGate.enabled?
+            error = CommandTower::Errors::Account::SmsCapabilityUnavailableError.new
+            return failure(
+              errors: [error],
+              http_status: CommandTower::Workflows::Me::ErrorMapping.http_status_for(error)
+            )
+          end
+
+          clear_result = CommandTower::Services::Account::ClearPhone.call(user: current_user)
+
+          unless clear_result.success?
+            error = clear_result.errors.first
+            return failure(
+              errors: clear_result.errors,
+              http_status: CommandTower::Workflows::Me::ErrorMapping.http_status_for(error)
+            )
+          end
+
+          user = clear_result.data[:user].reload
+          capabilities = CommandTower::Services::Me::Capabilities.project(user)
+          payload = CommandTower::Serializers::Me::AccountSerializer.serialize(
+            user,
+            capabilities: capabilities
+          )
+
+          success(
+            payload: payload,
+            http_status: :ok,
+            response_effects: expire_header_effects(auth_context)
+          )
+        end
+
+        private
+
+        def expire_header_effects(auth_context)
+          return if auth_context.nil?
+
+          { set_expire_header: auth_context.token_expires_at }
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/me/error_mapping.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Me
+      # HTTP status mapping for Me/Account workflow failures.
+      # Includes phone (2.8) and pushover (host until 2.9) account errors.
+      module ErrorMapping
+        module_function
+
+        def http_status_for(error)
+          case error
+          when CommandTower::Errors::ForbiddenError
+            :forbidden
+          when CommandTower::Errors::Auth::EmailVerificationRequiredError
+            :precondition_failed
+          when CommandTower::Errors::UnauthorizedError
+            :unauthorized
+          when CommandTower::Errors::Account::PhoneVerificationCodeInvalidError,
+               CommandTower::Errors::Account::PhoneVerificationExpiredError,
+               CommandTower::Errors::Account::PhoneVerificationStaleError,
+               CommandTower::Errors::Account::PhoneMissingError,
+               CommandTower::Errors::Account::PhoneAlreadyVerifiedError,
+               CommandTower::Errors::Account::PushoverNotConfiguredError,
+               CommandTower::Errors::Account::PushoverAlreadyConfiguredError,
+               CommandTower::Errors::Account::PushoverVerificationFailedError,
+               CommandTower::Errors::ValidationError
+            :unprocessable_entity
+          when CommandTower::Errors::Account::PhoneVerificationThrottledError
+            :too_many_requests
+          when CommandTower::Errors::Account::SmsCapabilityUnavailableError,
+               CommandTower::Errors::Account::PushoverCapabilityUnavailableError
+            :service_unavailable
+          when CommandTower::Errors::Account::PhoneVerificationSendFailedError,
+               CommandTower::Errors::Account::PushoverProviderUnavailableError
+            :bad_gateway
+          when CommandTower::Errors::InternalError
+            :internal_server_error
+          else
+            :internal_server_error
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/me/error_status.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Me
+      module ErrorStatus
+        module_function
+
+        def http_status_for(error)
+          case error
+          when CommandTower::Errors::ForbiddenError
+            :forbidden
+          when CommandTower::Errors::Auth::EmailVerificationRequiredError
+            :precondition_failed
+          when CommandTower::Errors::UnauthorizedError
+            :unauthorized
+          when CommandTower::Errors::ValidationError
+            :unprocessable_entity
+          when CommandTower::Errors::InternalError
+            :internal_server_error
+          else
+            :internal_server_error
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/me/phone_verification/send_workflow.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Me
+      module PhoneVerification
+        class SendWorkflow < CommandTower::Workflows::ApplicationWorkflow
+          retry_strategy :none
+
+          def call(current_user:, auth_context: nil)
+            unless CommandTower::Services::Me::SmsProductGate.enabled?
+              error = CommandTower::Errors::Account::SmsCapabilityUnavailableError.new
+              return failure(
+                errors: [error],
+                http_status: CommandTower::Workflows::Me::ErrorMapping.http_status_for(error)
+              )
+            end
+
+            send_result = CommandTower::Services::Account::PhoneVerification::Send.call(user: current_user)
+
+            unless send_result.success?
+              error = send_result.errors.first
+              return failure(
+                errors: send_result.errors,
+                http_status: CommandTower::Workflows::Me::ErrorMapping.http_status_for(error),
+                meta: throttle_meta(error) || {}
+              )
+            end
+
+            data = send_result.data
+            success(
+              payload: {
+                codeLength: data[:code_length],
+                expiresAt: iso(data[:expires_at]),
+                resendAvailableAt: iso(data[:resend_available_at]),
+                phoneNumber: data[:phone_number]
+              }.compact,
+              http_status: :ok,
+              response_effects: expire_header_effects(auth_context)
+            )
+          end
+
+          private
+
+          def iso(value)
+            value.respond_to?(:iso8601) ? value.iso8601 : value
+          end
+
+          def throttle_meta(error)
+            return unless error.is_a?(CommandTower::Errors::Account::PhoneVerificationThrottledError)
+            return if error.resend_available_at.blank?
+
+            { resendAvailableAt: iso(error.resend_available_at) }
+          end
+
+          def expire_header_effects(auth_context)
+            return if auth_context.nil?
+
+            { set_expire_header: auth_context.token_expires_at }
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/me/phone_verification/verify_workflow.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Me
+      module PhoneVerification
+        class VerifyWorkflow < CommandTower::Workflows::ApplicationWorkflow
+          retry_strategy :none
+
+          def call(current_user:, code:, auth_context: nil)
+            unless CommandTower::Services::Me::SmsProductGate.enabled?
+              error = CommandTower::Errors::Account::SmsCapabilityUnavailableError.new
+              return failure(
+                errors: [error],
+                http_status: CommandTower::Workflows::Me::ErrorMapping.http_status_for(error)
+              )
+            end
+
+            verify_result = CommandTower::Services::Account::PhoneVerification::Verify.call(
+              user: current_user,
+              code:
+            )
+
+            unless verify_result.success?
+              error = verify_result.errors.first
+              return failure(
+                errors: verify_result.errors,
+                http_status: CommandTower::Workflows::Me::ErrorMapping.http_status_for(error)
+              )
+            end
+
+            user = verify_result.data[:user].reload
+            capabilities = CommandTower::Services::Me::Capabilities.project(user)
+            payload = CommandTower::Serializers::Me::AccountSerializer.serialize(
+              user,
+              capabilities: capabilities
+            )
+
+            success(
+              payload: payload,
+              http_status: :ok,
+              response_effects: expire_header_effects(auth_context)
+            )
+          end
+
+          private
+
+          def expire_header_effects(auth_context)
+            return if auth_context.nil?
+
+            { set_expire_header: auth_context.token_expires_at }
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/me/pushover/create_workflow.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Me
+      module Pushover
+        class CreateWorkflow < CommandTower::Workflows::ApplicationWorkflow
+          retry_strategy :none
+
+          def call(current_user:, user_key:, application_token:, auth_context: nil)
+            unless CommandTower::Services::Me::PushoverProductGate.enabled?
+              return failure(**WorkflowSupport.capability_failure)
+            end
+
+            result = CommandTower::Services::Account::Pushover::Create.call(
+              user: current_user,
+              user_key:,
+              application_token:
+            )
+            unless result.success?
+              error = result.errors.first
+              return failure(
+                errors: result.errors,
+                http_status: CommandTower::Workflows::Me::ErrorMapping.http_status_for(error)
+              )
+            end
+
+            success(
+              payload: WorkflowSupport.serialize_view(result.data[:safe_view]),
+              http_status: :ok,
+              response_effects: WorkflowSupport.expire_header_effects(auth_context)
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/me/pushover/destroy_workflow.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Me
+      module Pushover
+        class DestroyWorkflow < CommandTower::Workflows::ApplicationWorkflow
+          retry_strategy :none
+
+          def call(current_user:, auth_context: nil)
+            unless CommandTower::Services::Me::PushoverProductGate.enabled?
+              return failure(**WorkflowSupport.capability_failure)
+            end
+
+            result = CommandTower::Services::Account::Pushover::Destroy.call(user: current_user)
+            unless result.success?
+              error = result.errors.first
+              return failure(
+                errors: result.errors,
+                http_status: CommandTower::Workflows::Me::ErrorMapping.http_status_for(error)
+              )
+            end
+
+            success(
+              payload: CommandTower::Serializers::Me::PushoverSerializer.unconfigured,
+              http_status: :ok,
+              response_effects: WorkflowSupport.expire_header_effects(auth_context)
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/me/pushover/replace_workflow.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Me
+      module Pushover
+        class ReplaceWorkflow < CommandTower::Workflows::ApplicationWorkflow
+          retry_strategy :none
+
+          def call(current_user:, user_key:, application_token:, auth_context: nil)
+            unless CommandTower::Services::Me::PushoverProductGate.enabled?
+              return failure(**WorkflowSupport.capability_failure)
+            end
+
+            result = CommandTower::Services::Account::Pushover::Replace.call(
+              user: current_user,
+              user_key:,
+              application_token:
+            )
+            unless result.success?
+              error = result.errors.first
+              return failure(
+                errors: result.errors,
+                http_status: CommandTower::Workflows::Me::ErrorMapping.http_status_for(error)
+              )
+            end
+
+            success(
+              payload: WorkflowSupport.serialize_view(result.data[:safe_view]),
+              http_status: :ok,
+              response_effects: WorkflowSupport.expire_header_effects(auth_context)
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/me/pushover/show_workflow.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Me
+      module Pushover
+        class ShowWorkflow < CommandTower::Workflows::ApplicationWorkflow
+          retry_strategy :none
+
+          def call(current_user:, auth_context: nil)
+            unless CommandTower::Services::Me::PushoverProductGate.enabled?
+              return failure(**WorkflowSupport.capability_failure)
+            end
+
+            result = CommandTower::Services::Account::Pushover::Show.call(user: current_user)
+            unless result.success?
+              error = result.errors.first
+              return failure(
+                errors: result.errors,
+                http_status: CommandTower::Workflows::Me::ErrorMapping.http_status_for(error)
+              )
+            end
+
+            success(
+              payload: WorkflowSupport.serialize_view(result.data[:safe_view]),
+              http_status: :ok,
+              response_effects: WorkflowSupport.expire_header_effects(auth_context)
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/me/pushover/verify_workflow.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Me
+      module Pushover
+        class VerifyWorkflow < CommandTower::Workflows::ApplicationWorkflow
+          retry_strategy :none
+
+          def call(current_user:, auth_context: nil)
+            unless CommandTower::Services::Me::PushoverProductGate.enabled?
+              return failure(**WorkflowSupport.capability_failure)
+            end
+
+            result = CommandTower::Services::Account::Pushover::Verify.call(user: current_user)
+            unless result.success?
+              error = result.errors.first
+              return failure(
+                errors: result.errors,
+                http_status: CommandTower::Workflows::Me::ErrorMapping.http_status_for(error)
+              )
+            end
+
+            success(
+              payload: WorkflowSupport.serialize_view(result.data[:safe_view]),
+              http_status: :ok,
+              response_effects: WorkflowSupport.expire_header_effects(auth_context)
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/me/pushover/workflow_support.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Me
+      module Pushover
+        module WorkflowSupport
+          module_function
+
+          def capability_failure
+            error = CommandTower::Errors::Account::PushoverCapabilityUnavailableError.new
+            {
+              errors: [error],
+              http_status: CommandTower::Workflows::Me::ErrorMapping.http_status_for(error)
+            }
+          end
+
+          def expire_header_effects(auth_context)
+            return if auth_context.nil?
+
+            { set_expire_header: auth_context.token_expires_at }
+          end
+
+          def serialize_view(safe_view)
+            CommandTower::Serializers::Me::PushoverSerializer.serialize(safe_view)
+          end
+        end
+      end
+    end
+  end
+end