command_tower 0.4.0 → 0.11.0

data/lib/tasks/users.rake

@@ -0,0 +1,119 @@
+# frozen_string_literal: true
+
+namespace :command_tower do
+  namespace :users do
+    desc "Create a new user with username, email, password, and optional roles"
+    task create: :environment do
+      # Initialize authorization to load available roles
+      begin
+        CommandTower::Authorization.default_defined! if CommandTower::Authorization.respond_to?(:default_defined!)
+      rescue StandardError => e
+        puts "Warning: Could not initialize authorization roles: #{e.message}"
+        puts "Continuing without role selection..."
+      end
+
+      puts "\n=== CommandTower User Creation ==="
+      puts
+
+      # Get basic user information
+      print "Username: "
+      username = $stdin.gets.chomp
+      raise "Username cannot be blank" if username.blank?
+
+      print "Email: "
+      email = $stdin.gets.chomp
+      raise "Email cannot be blank" if email.blank?
+
+      print "Password: "
+      password = $stdin.noecho(&:gets).chomp
+      puts
+      raise "Password cannot be blank" if password.blank?
+
+      print "First Name: "
+      first_name = $stdin.gets.chomp
+      raise "First name cannot be blank" if first_name.blank?
+
+      print "Last Name: "
+      last_name = $stdin.gets.chomp
+      raise "Last name cannot be blank" if last_name.blank?
+
+      # Check if user should be admin
+      print "Is this an admin user? (y/n): "
+      is_admin = $stdin.gets.chomp.downcase == "y"
+
+      # Get available roles
+      roles_to_assign = []
+      available_roles = []
+
+      begin
+        available_roles = CommandTower::Authorization::Role.roles.keys.sort
+      rescue StandardError => e
+        puts "Warning: Could not load available roles: #{e.message}"
+      end
+
+      if is_admin
+        if available_roles.include?("admin")
+          roles_to_assign << "admin"
+        else
+          puts "Warning: 'admin' role is not available in the RBAC configuration."
+        end
+      end
+
+      # Allow selection of additional roles if any are available
+      if available_roles.any?
+        puts "\nAvailable RBAC Roles:"
+        available_roles.each_with_index do |role, index|
+          begin
+            role_obj = CommandTower::Authorization::Role.roles[role]
+            description = role_obj&.description || "No description"
+            puts "  #{index + 1}. #{role} - #{description}"
+          rescue StandardError
+            puts "  #{index + 1}. #{role}"
+          end
+        end
+
+        puts "\nSelect additional roles (enter numbers separated by commas, or press Enter to skip):"
+        print "Roles: "
+        role_selection = $stdin.gets.chomp
+
+        unless role_selection.blank?
+          selected_indices = role_selection.split(",").map(&:strip).map(&:to_i)
+          selected_indices.each do |index|
+            if index > 0 && index <= available_roles.length
+              selected_role = available_roles[index - 1]
+              roles_to_assign << selected_role unless roles_to_assign.include?(selected_role)
+            end
+          end
+        end
+      else
+        puts "\nNo additional RBAC roles are configured."
+      end
+
+      # Create the user
+      puts "\nCreating user..."
+      user = ::User.new(
+        username: username,
+        email: email,
+        password: password,
+        first_name: first_name,
+        last_name: last_name,
+        roles: roles_to_assign.uniq
+      )
+
+      if user.save
+        puts "\n✓ User created successfully!"
+        puts "  Username: #{user.username}"
+        puts "  Email: #{user.email}"
+        puts "  Name: #{user.full_name}"
+        puts "  Roles: #{user.roles.empty? ? 'none' : user.roles.join(', ')}"
+        puts "  ID: #{user.id}"
+      else
+        puts "\n✗ Failed to create user:"
+        user.errors.full_messages.each do |error|
+          puts "  - #{error}"
+        end
+        raise "User creation failed"
+      end
+    end
+  end
+end

data/spec/factories/entity.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :authorization_entity, class: CommandTower::Authorization::Entity do
+    controller { Class.new(::CommandTower::ApplicationController) }
+    sequence(:name) { |n| "entity_#{n}" }
+
+    transient do
+      additional_method_count { 5 }
+      additional_methods { [] }
+      method_name { "action_#{SecureRandom.hex(3)}" }
+    end
+
+    trait :only do
+      only { method_name }
+    end
+
+    trait :except do
+      except { method_name }
+    end
+
+    trait :additional_methods do
+      additional_methods do
+        Array.new(additional_method_count) { |i| "extra_#{i}_#{SecureRandom.hex(2)}" }
+      end
+    end
+
+    initialize_with do
+      methods = (defined?(only) ? Array(only) : []) + (defined?(except) ? Array(except) : []) + additional_methods
+      methods.compact.each do |meth|
+        controller.define_method(meth) {}
+      end
+
+      new(**attributes)
+    end
+  end
+end

data/spec/factories/impersonation_session.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :impersonation_session, class: "CommandTower::Impersonation::Session" do
+    association :actor, factory: :user
+    association :target, factory: :user
+    started_at { Time.current }
+    last_activity_at { Time.current }
+    idle_expires_at { 10.minutes.from_now }
+    absolute_expires_at { 1.hour.from_now }
+
+    trait :ended do
+      ended_at { Time.current }
+      end_reason { "manual" }
+    end
+  end
+end

data/spec/factories/messaging.rb

@@ -0,0 +1,156 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :messaging_communication, class: "CommandTower::Messaging::Communication" do
+    user
+    notification_type_key { "example.type" }
+    sequence(:title) { |n| "Message title #{n}" }
+    sequence(:body) { |n| "Message body #{n}." }
+    metadata { nil }
+    execution_handoff_status { CommandTower::Messaging::Communication::HANDOFF_COMPLETE }
+
+    trait :with_destination_plan do
+      after(:create) do |communication|
+        create(:messaging_destination_plan, communication:)
+      end
+    end
+
+    trait :with_inbox_item do
+      after(:create) do |communication|
+        create(:messaging_inbox_item, communication:)
+      end
+    end
+
+    trait :handoff_pending do
+      execution_handoff_status { CommandTower::Messaging::Communication::HANDOFF_PENDING }
+    end
+  end
+
+  factory :messaging_destination_plan, class: "CommandTower::Messaging::DestinationPlan" do
+    communication factory: :messaging_communication
+    decision do
+      {
+        "selected_channels" => %w[email],
+        "inbox_selected" => false,
+        "mandatory" => false,
+        "platform_enabled_channels" => %w[email],
+        "excluded_destinations" => [],
+      }
+    end
+  end
+
+  factory :messaging_inbox_item, class: "CommandTower::Messaging::InboxItem" do
+    communication factory: :messaging_communication
+    status { CommandTower::Messaging::InboxItem::STATUS_CREATED }
+
+    trait :viewed do
+      viewed_at { Time.current }
+      status { CommandTower::Messaging::InboxItem::STATUS_VIEWED }
+    end
+
+    trait :archived do
+      archived_at { Time.current }
+      status { CommandTower::Messaging::InboxItem::STATUS_ARCHIVED }
+    end
+
+    trait :deleted do
+      deleted_at { Time.current }
+      status { CommandTower::Messaging::InboxItem::STATUS_DELETED }
+    end
+  end
+
+  factory :messaging_channel_delivery, class: "CommandTower::Messaging::ChannelDelivery" do
+    communication factory: :messaging_communication
+    channel_key { "email" }
+  end
+
+  factory :messaging_delivery_attempt, class: "CommandTower::Messaging::DeliveryAttempt" do
+    channel_delivery factory: :messaging_channel_delivery
+    status { CommandTower::Messaging::DeliveryAttempt::STATUS_STARTED }
+    started_at { Time.current }
+  end
+
+  factory :messaging_notification_preference, class: "CommandTower::Messaging::NotificationPreference" do
+    user
+    notification_type_key { "example.type" }
+    state { { "channels" => {}, "inbox" => true } }
+  end
+
+  factory :messaging_endpoint, class: "CommandTower::Messaging::Endpoint" do
+    user
+    channel_key { "push" }
+    lifecycle_state { "active" }
+    verification_state { "unverified" }
+
+    transient do
+      sequence(:push_token) { |n| "ExponentPushToken[factory#{n.to_s.rjust(8, '0')}]" }
+      pushover_user_key { "pushover-user-key-abcd" }
+      pushover_application_token { "pushover-app-token-zzzz" }
+    end
+
+    address_ciphertext do
+      CommandTower::Messaging::Endpoints::SecretBox.encrypt(push_token).fetch(:ciphertext)
+    end
+    address_fingerprint do
+      CommandTower::Messaging::Endpoints::Fingerprinter.fingerprint(push_token)
+    end
+    masked_display_value { "Device registered" }
+    encryption_key_version { CommandTower::Messaging::Endpoints::SecretBox.key_version }
+
+    trait :pushover do
+      channel_key { "pushover" }
+      address_ciphertext { nil }
+      address_fingerprint do
+        CommandTower::Messaging::Endpoints::Fingerprinter.fingerprint(
+          "#{pushover_user_key}\n#{pushover_application_token}",
+        )
+      end
+      masked_display_value do
+        key = pushover_user_key.to_s
+        key.length >= 4 ? "#{"•" * 8}#{key[-4, 4]}" : "configured"
+      end
+      encryption_key_version { CommandTower::Messaging::Endpoints::SecretBox.key_version }
+    end
+
+    trait :revoked do
+      lifecycle_state { "revoked" }
+      revoked_at { Time.current }
+    end
+
+    trait :verified do
+      verification_state { "verified" }
+      verified_at { Time.current }
+    end
+  end
+
+  factory :messaging_endpoint_pushover_credential,
+          class: "CommandTower::Messaging::EndpointPushoverCredential" do
+    transient do
+      pushover_user_key { "pushover-user-key-abcd" }
+      pushover_application_token { "pushover-app-token-zzzz" }
+    end
+
+    endpoint do
+      association(
+        :messaging_endpoint,
+        :pushover,
+        pushover_user_key:,
+        pushover_application_token:,
+      )
+    end
+
+    user_key_ciphertext do
+      CommandTower::Messaging::Endpoints::SecretBox.encrypt(
+        pushover_user_key,
+        purpose: CommandTower::Messaging::Endpoints::SecretBox::PUSHOVER_USER_KEY_PURPOSE,
+      ).fetch(:ciphertext)
+    end
+    application_token_ciphertext do
+      CommandTower::Messaging::Endpoints::SecretBox.encrypt(
+        pushover_application_token,
+        purpose: CommandTower::Messaging::Endpoints::SecretBox::PUSHOVER_APPLICATION_TOKEN_PURPOSE,
+      ).fetch(:ciphertext)
+    end
+    encryption_key_version { CommandTower::Messaging::Endpoints::SecretBox.key_version }
+  end
+end

data/spec/factories/role.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :authorization_role, class: CommandTower::Authorization::Role do
+    name { "role_#{SecureRandom.hex(4)}" }
+    allow_everything { false }
+    description { "Authorization role for tests" }
+    entities { build_list(:authorization_entity, 2) }
+
+    trait :allow_everything do
+      allow_everything { true }
+      entities { [] }
+    end
+
+    trait :with_create_role do
+      transient do
+        with_create_role { true }
+      end
+    end
+
+    initialize_with do
+      if defined?(with_create_role)
+        CommandTower::Authorization::Role.create_role(**attributes)
+      else
+        new(**attributes)
+      end
+    end
+  end
+end

data/spec/factories/user.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :user do
+    sequence(:email) { |n| "user#{n}-#{SecureRandom.hex(4)}@example.com" }
+    sequence(:username) { |n| "user#{n}#{SecureRandom.hex(3)}" }
+    first_name { "Test" }
+    last_name { "User" }
+    password { "password1234" }
+    password_confirmation { password }
+    email_validated { true }
+    roles { [] }
+
+    trait :unvalidated_email do
+      email_validated { false }
+    end
+
+    # Alias for hosts that previously used this name (e.g. DoubleFloor Me).
+    trait :unverified do
+      unvalidated_email
+    end
+
+    trait :verifier_token do
+      verifier_token { SecureRandom.alphanumeric(32) }
+    end
+
+    trait :privileged_roles do
+      roles { ["admin", "owner"] }
+    end
+
+    trait :admin_roles do
+      roles { ["admin"] }
+    end
+
+    trait :role_admin do
+      roles { ["admin"] }
+    end
+
+    trait :role_owner do
+      roles { ["owner"] }
+    end
+
+    trait :role_impersonation_operator do
+      roles { ["impersonation_operator"] }
+    end
+
+    trait :role_rbac_admin do
+      roles { ["rbac_admin"] }
+    end
+
+    trait :role_support_admin do
+      roles { ["support_admin"] }
+    end
+
+    trait :role_users_identity_admin do
+      roles { ["users_identity_admin"] }
+    end
+
+    trait :without_phone do
+      phone_number { nil }
+      phone_number_validated { false }
+    end
+
+    trait :with_unverified_phone do
+      sequence(:phone_number) { |n| format("+1415555%04d", n % 10_000) }
+      phone_number_validated { false }
+    end
+  end
+end

data/spec/factories/user_secret.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :user_secret, class: "UserSecret" do
+    user
+    reason { CommandTower::Secrets::EMAIL_VERIFICIATION.to_s }
+    sequence(:secret) { |n| "secret-#{n}-#{SecureRandom.hex(8)}" }
+    death_time { 1.hour.from_now }
+    use_count { 0 }
+    use_count_max { 5 }
+  end
+end