has_helpers 5.0.2

data/lib/has_helpers/resource_importer.rb

@@ -0,0 +1,260 @@
+# frozen_string_literal: true
+
+module HasHelpers
+  class ResourceImporter
+    attr_accessor :mem_resources # Memoize already read resources. Hash containing the resource, its ancestors, and descendants
+
+    AuditError = Class.new(::StandardError)
+    AUDIT_MISSING_RESOURCES = "Application: %{application_name}, Resources: %{resources} were flagged during an audit. The resources may need to be migrated to match a new name or removed as the case may require."
+    AUDIT_MISSING_NESTED_RESOURCES = "Application: %{application_name}, Resource: %{resource_name}, Nested_resources: %{nested_resources} were flagged during an audit. The nested resources may need to be migrated to match a new name or removed as the case may require."
+
+    def self.import_resources(*applications, audit: true)
+      self.new(*applications).import_resources(audit: audit)
+    end
+
+    def self.create_importable_resources_for(resource, application)
+      new(application).create_importable_resources_for(resource, application)
+    end
+
+    def initialize(*applications)
+      @applications = applications.presence
+      @mem_resources ||= []
+      @ancestors ||= {}
+      @descendants ||= {}
+    end
+
+    def import_resource_nested_resources(resource, audit: true)
+      add_nested_resources(resource)
+      run_audit(audit) { audit_nested_resources(resource) }
+    rescue AuditError => e
+      e.message
+    end
+
+    def import_resources(audit: true)
+      [].tap do |errors|
+        errors.concat(import_resources!(audit: audit))
+        errors.concat(import_nested_resources!(audit: audit)) if errors.empty?
+      end
+    end
+
+    def import_resources!(audit: true)
+      [].tap do |errors|
+        applications.each do |application|
+          run_audit(audit) { audit_resources(application) }
+          active_record_models.each do |model_klass|
+            next if model_klass.name == "primary::SchemaMigration"
+            meta_data = resource_meta_data(model_klass)
+            if model_klass.respond_to?(:table_exists?) && model_klass.table_exists?
+              resource = ::HasHelpers::Resource.find_or_create_by(name: model_klass.name, application: application, resource_type: meta_data.resource_type, alias_name: meta_data.alias_name)
+              @mem_resources << { resource: resource, ancestors: ancestor_resources(resource), descendants: descendants_resources(resource) }
+            end
+          end
+        rescue AuditError => e
+          errors << e.message
+        end
+      end
+    end
+
+    def import_nested_resources!(audit: true)
+      [].tap do |errors|
+        applications.each do |application|
+          application.resources.where(parent_id: nil).find_each do |resource|
+            add_nested_resources(resource)
+            run_audit(audit) { audit_nested_resources(resource) }
+          rescue AuditError => e
+            errors << e.message
+          end
+        end
+      end
+    end
+
+    def add_field_resources(resource)
+      # Create fields resources for the resource with BelongsToReflection associations
+      if resource.klass(safe: true) && resource.klass.respond_to?(:table_exists?) && resource.klass.table_exists?
+        meta_data = resource_meta_data(resource.klass)
+        associations = meta_data.associations.select { |_, value| value[:assoc_type] == "BelongsToReflection" }
+        resource.klass.columns.each do |column|
+          resource_type = column.null ? ::HasHelpers::ResourceType::FIELD : ::HasHelpers::ResourceType::REQUIRED_FIELD
+          association_class = associations[column.name] ? associations[column.name][:class_name] : nil
+          field_resource_id = nil
+          if association_class && association_class.safe_constantize
+            field_resource_id = HasHelpers::Resource.find_by(name: association_class, parent_id: nil, application: resource.application)&.id
+            if association_class.constantize < ::Option
+              field_resource_id = ::HasHelpers::Resource.find_by(name: "Option", parent_id: nil, application: resource.application)&.id
+            end
+          end
+
+          HasHelpers::Resource.find_or_create_by(
+            resource_type: resource_type,
+            application: resource.application,
+            parent_id: resource.id,
+            name: column.name,
+            field_resource_id: field_resource_id,
+            alias_name: column.name,
+            field_class_name: association_class
+          )
+        end
+      end
+    end
+
+    # check if the branch already has the resource and if not save it
+    # This is to avoid infinite recursion with resources in case of a circular reference such as A -> B -> C -> A
+    # e.g., Hierarchy contains a Hierarchy and that a Hierarchy and so on...
+    def create_branch_resource(resource)
+      # Find the base resource (the one without a parent)
+      mem_record = @mem_resources.find { |mem_res| mem_res[:resource] == resource }
+      base_resource = mem_record[:ancestors].find { |r| r.parent_id == nil } if mem_record
+      base_resource = ancestor_resources(resource).find { |r| r.parent_id == nil } unless base_resource
+      return false unless base_resource
+      base_resource_mem_record = @mem_resources.find { |mem_res| mem_res[:resource].name == base_resource.name && mem_res[:resource].application_id == base_resource.application.id && mem_res[:resource].resource_type_id == base_resource.resource_type.id }
+      if !base_resource_mem_record
+        base_resource_mem_record = { resource: base_resource, ancestors: ancestor_resources(base_resource), descendants: descendants_resources(base_resource) }
+        @mem_resources << base_resource_mem_record
+      end
+      # Check if the resource exists in the branch
+      all_descendants = base_resource_mem_record[:descendants]
+      exists = all_descendants.select { |r| r.name == resource.name && r.application_id == resource.application.id && r.resource_type_id == resource.resource_type.id }
+      # we only want to save if the resource does not exist in the branch, if it is a valid active record model, and if the table exists
+      if resource.klass(safe: true) && active_record_models.include?(resource.klass) && resource.klass.respond_to?(:table_exists?) && resource.klass.table_exists?
+        if exists.empty?
+          resource.save!
+          @mem_resources << { resource: resource, ancestors: ancestor_resources(resource), descendants: descendants_resources(resource) }
+          base_resource_mem_record[:descendants] << resource if base_resource_mem_record
+          return true
+        else
+          # check if the resource path though its parent is the same. If not then save the resource.
+          # e.g. A -> B -> C   && A -> F -> C then C after F should be saved as a new resource
+          exists.each do |exist_resource|
+            exist_resource_ancestors = ancestor_resources(exist_resource)
+            resource_ancestors = ancestor_resources(resource)
+            if exist_resource_ancestors.map(&:name).to_set != resource_ancestors.map(&:name).reject { |name| name == exist_resource.name }.to_set && resource_ancestors.map(&:name).reject { |name| name == exist_resource.name }.to_set.present?
+              resource.save!
+              @mem_resources << { resource: resource, ancestors: ancestor_resources(resource), descendants: descendants_resources(resource) }
+              base_resource_mem_record[:descendants] << resource if base_resource_mem_record
+              return true
+            end
+          end
+        end
+      end
+      false
+    end
+
+    def lacks_of_nested_resources(resource)
+      if resource.persisted?
+        meta_data = resource_meta_data(resource.klass)
+        return meta_data.nested_resources.present? && meta_data.nested_resources.to_set != resource.nested_resources.not_fields.map(&:name).to_set
+      end
+      false
+    end
+
+    def add_nested_resources(resource)
+      return unless resource.klass(safe: true) && resource.klass.respond_to?(:table_exists?) && resource.klass.table_exists?
+      if [HasHelpers::ResourceType::BASE, HasHelpers::ResourceType::NESTED, HasHelpers::ResourceType::TYPE, HasHelpers::ResourceType::SUB].include?(resource.resource_type)
+        meta_data = resource_meta_data(resource.klass)
+        # Create nested resources
+        # recursive for each nested resource created
+        meta_data.nested_resources.each do |nested_resource_name|
+          nested_resource = ::HasHelpers::Resource.find_or_initialize_by(parent_id: resource.id, name: nested_resource_name, application_id: resource.application.id, resource_type: ::HasHelpers::ResourceType::NESTED)
+          if create_branch_resource(nested_resource) || lacks_of_nested_resources(nested_resource)
+            add_nested_resources(nested_resource) # recursive call add next nested resource in branch
+          elsif nested_resource.new_record? # already exists no need to create it
+            nested_resource.destroy
+          end
+        end
+
+        # Create split resources
+        meta_data.split_resources.each do |split_resource_name|
+          ::HasHelpers::Resource.find_or_create_by(parent_id: resource.id, name: split_resource_name, application_id: resource.application.id, resource_type: ::HasHelpers::ResourceType::SPLIT)
+        end
+
+        # Create fields resources
+        add_field_resources(resource)
+      end
+    end
+
+    def audit_resources(application)
+      existing_resources = application.resources.where.not(resource_type: [::HasHelpers::ResourceType::SPLIT, ::HasHelpers::ResourceType::FIELD, ::HasHelpers::ResourceType::REQUIRED_FIELD]).map(&:name)
+      new_resources = active_record_models.map(&:name).to_a
+      missing_resources = existing_resources - new_resources
+
+      if missing_resources.present?
+        raise AuditError, AUDIT_MISSING_RESOURCES % { application_name: application.name, resources: missing_resources }
+      end
+    end
+
+    def audit_nested_resources(resource)
+      return if resource.klass(safe: true).blank?
+      meta_data = resource_meta_data(resource.klass)
+      existing_nested_resources = resource.nested_resources.map(&:name)
+      new_nested_resources = meta_data.nested_resources + meta_data.split_resources + meta_data.fields_resources
+      missing_nested_resources = existing_nested_resources - new_nested_resources
+
+      if missing_nested_resources.present?
+        raise AuditError, AUDIT_MISSING_NESTED_RESOURCES % { application_name: resource.application.name, resource_name: resource.name, nested_resources: missing_nested_resources }
+      end
+    end
+
+    def create_importable_resources_for(resource, application)
+      model = resource&.name&.safe_constantize
+      return if model.blank?
+      return unless model.respond_to?(:importable_accessors)
+
+      model.importable_accessors.each do |accessor_name|
+        accessor_name = accessor_name.to_s
+        ::HasHelpers::Resource.find_or_create_by!(
+          parent_id: resource.id,
+          name: accessor_name,
+          application: application,
+          resource_type: ::HasHelpers::ResourceType::ACCESSOR_FIELD,
+          alias_name: accessor_name.humanize.titleize
+        )
+      end
+    end
+
+    private
+
+    def ancestor_resources(resource)
+      @ancestors[resource] ||= begin
+                                 parents = []
+                                 parent = resource.parent
+                                 while parent
+                                   parents << parent
+                                   parent = parent.parent
+                                 end
+                                 @ancestors[resource] = parents
+                                 parents
+                               end
+    end
+
+    def descendants_resources(resource)
+      @descendants[resource] ||= begin
+                                   descendants = resource.nested_resources.where(resource_type_id: "HasHelpers::ResourceType::::Nested").flat_map do |nested_resource|
+                                     [nested_resource, *descendants_resources(nested_resource)]
+                                   end
+                                   @descendants[resource] = descendants
+                                   descendants
+                                 end
+    end
+
+    def active_record_models
+      ::ActiveRecord::Base.descendants.lazy.select(&:name) + ::HasHelpers::ApplicationRecord.descendants.lazy.select(&:name)
+    end
+
+    def applications
+      @applications ||= ::HasHelpers::Application.where(project: ::HasHelpers::Application.project) # TODO: eliminate project
+    end
+
+    def resource_meta_data(model_klass)
+      ::HasHelpers::Resources.lookup(model_klass.name)
+    end
+
+    def run_audit(perform)
+      if perform
+        Rails.logger.debug("Running audit")
+        yield
+      else
+        Rails.logger.debug("Skipping audit")
+      end
+    end
+  end
+end

data/lib/has_helpers/resources.rb

@@ -0,0 +1,127 @@
+# frozen_string_literal: true
+
+module HasHelpers::Resources
+  def self.configure_resources(&block)
+    instance_eval(&block)
+  end
+
+  def self.base_resource(resource_name, **options, &block)
+    wrapped_block = proc do
+      instance_eval(&block) if block_given?
+      resource_type ::HasHelpers::ResourceType::BASE
+    end
+    update_resource(resource_name, **options, &wrapped_block)
+  end
+
+  def self.sub_resource(resource_name, **options, &block)
+    wrapped_block = proc do
+      instance_eval(&block) if block_given?
+      resource_type ::HasHelpers::ResourceType::SUB
+    end
+    update_resource(resource_name, **options, &wrapped_block)
+  end
+
+  def self.update_resource(resource_name, **options, &block)
+    lookup(resource_name).tap do |resource_meta|
+      resource_meta.assign_attributes(options)
+      resource_meta.instance_eval(&block) if block_given?
+    end
+  end
+
+  def self.resource_meta_data_cache
+    @resource_meta_data_cache ||= {}
+  end
+
+  def self.lookup(resource_name)
+    resource_meta_data_cache[resource_name] ||= ::HasHelpers::Resources::Meta.new(resource_name)
+  end
+
+  class Meta
+    include ::HasHelpers::Attributes
+
+    attr_accessor :resource_name
+    attr_writer :alias_name, :klass, :resource_type
+
+    def initialize(resource_name, **options)
+      @resource_name = resource_name
+      super(options)
+    end
+
+    def alias_name(name = nil)
+      @alias_name ||= name
+    end
+
+    def add(*resources)
+      @added_nested_resources = normalize_resource_names(resources)
+    end
+
+    def remove(*resources)
+      @excluded_nested_resources = normalize_resource_names(resources)
+    end
+
+    def added_nested_resources
+      @added_nested_resources ||= []
+    end
+
+    def excluded_nested_resources
+      @excluded_nested_resources ||= []
+    end
+
+    def klass(safe: false)
+      @klass ||= safe ? resource_name.safe_constantize : resource_name.constantize
+    end
+
+    def split_resources(*resources)
+      @split_resources ||= normalize_resource_names(resources)
+    end
+
+    def fields_resources
+      klass.table_exists? ? klass.column_names : []
+    end
+
+    # @return Hash { "list_id" => :class_name => "List", :assoc_type => "has_many or has_one or belogns_to" }
+    def associations
+      @associations ||= begin
+                          associations = {}
+                          klass.reflect_on_all_associations.map do |assoc|
+                            # HasManyReflection, HasOneReflection, and BelongsToReflection
+                            if (assoc.is_a?(ActiveRecord::Reflection::HasManyReflection) || assoc.is_a?(ActiveRecord::Reflection::HasOneReflection) || assoc.is_a?(ActiveRecord::Reflection::BelongsToReflection)) &&
+                               klass.reflect_on_association(assoc.name).klass.respond_to?(:table_exists?) && klass.reflect_on_association(assoc.name).klass.table_exists?
+                              associations["#{assoc.name}_id"] = { class_name: klass.reflect_on_association(assoc.name).klass.name, assoc_type: assoc.class.to_s.split("::").last }
+                            end
+                          rescue NameError
+                            if assoc.class_name.present?
+                              if (assoc.is_a?(ActiveRecord::Reflection::HasManyReflection) || assoc.is_a?(ActiveRecord::Reflection::HasOneReflection) || assoc.is_a?(ActiveRecord::Reflection::BelongsToReflection)) &&
+                                 assoc.class_name.safe_constantize.respond_to?(:table_exists?) && assoc.class_name.safe_constantize.table_exists?
+                                associations["#{assoc.name}_id"] = { class_name: assoc.class_name.delete_prefix("::"), assoc_type: assoc.class.to_s.split("::").last }
+                              end
+                            end
+                          rescue => e
+                            p e
+                          end if klass.respond_to?(:reflect_on_all_associations)
+                          associations
+                        end
+    end
+
+    def resource_type(rt = nil)
+      self.resource_type = rt if rt
+      @resource_type ||= (klass.base_class != klass && ::HasHelpers::Resources.lookup(klass.base_class.name).resource_type == ::HasHelpers::ResourceType::BASE) ? ::HasHelpers::ResourceType::TYPE : ::HasHelpers::ResourceType::NESTED
+    end
+
+    def nested_resources
+      return [] if klass(safe: true).blank?
+      nested_resources = klass.nested_attributes_options.
+                               lazy.
+                               map { |nested_attribute, _| klass.reflect_on_association(nested_attribute).klass.name }.
+                               reject { |nested_attribute| excluded_nested_resources.include?(nested_attribute) }.
+        reject { |nested_attribute| ::HasHelpers::Resources.lookup(nested_attribute).resource_type == ::HasHelpers::ResourceType::SUB }.to_a.compact if klass.respond_to?(:nested_attributes_options)
+      added_nested_resources.concat(nested_resources).uniq
+    end
+
+    private
+
+    def normalize_resource_names(resources)
+      resources.map { |r| r.delete_prefix("::") }
+    end
+  end
+end

data/lib/has_helpers/rspec/constants.rb

@@ -0,0 +1,61 @@
+# typed: false
+# frozen_string_literal: true
+
+# This file should include any shared examples, factories, etc. which may be needed
+# by consumers of this gem for testing.
+require "has_helpers"
+require "testhq"
+
+describe ::HasHelpers::Constant do
+  let(:ignored_classes) do
+    [
+      # ::Color, ::FileFormat and ::Icon are fake constants that were seeded dynamically through a migration.
+      # These do not exist in memory so you can not reference them using `Color::ALL` or `Color::GREY`.
+      ::Color,
+      ::FileFormat,
+      ::Icon,
+      ::Option,
+      ::TimeZone
+    ]
+  end
+
+  let(:constant_classes) do
+    ::ActiveRecord::Base.descendants.select do |k|
+      k.include?(::HasHelpers::Constant) && !ignored_classes.include?(k)
+    end.uniq
+  end
+
+  it "persists all constants" do
+    aggregate_failures do
+      constant_classes.each do |klass|
+        if !klass.simple
+          constants_to_seed = klass::ALL.select { |c| !klass.where(id: c.id).exists? }
+          constants_to_seed_error_message = <<~ERROR
+            expected `#{klass.name}` to have seeded constants.
+            Create a migration to seed the following constants: `#{klass.name}.seed!`
+              #{constants_to_seed.map(&:id).sort.join("\n  ")}
+          ERROR
+          expect(constants_to_seed).to be_empty, constants_to_seed_error_message
+        else
+          expect { klass::ALL.each(&:id) }.not_to raise_error
+        end
+      end
+    end
+  end
+
+  it "has no dead constants" do
+    aggregate_failures do
+      constant_classes.each do |klass|
+        dead_constants = klass.all - klass::ALL
+        dead_constant_error_message = <<~ERROR
+          expected `#{klass.name}` to have no dead constants.
+          Create a data migration to remove the following constants:
+            #{dead_constants.map(&:name).sort.join("\n  ")}
+        ERROR
+        expect(dead_constants).to be_empty, dead_constant_error_message
+      rescue NameError
+        # do nothing
+      end
+    end
+  end
+end

data/lib/has_helpers/rspec/factories.rb

@@ -0,0 +1,11 @@
+# typed: false
+# frozen_string_literal: true
+
+# This file should include any shared examples, factories, etc. which may be needed
+# by consumers of this gem for testing.
+require "has_helpers"
+require "testhq"
+
+# Make sure that the following paths are added in the gemspec. Otherwise they
+# will not be available when requiring a released version of the has_badges gem.
+::Testhq.register_factory_definition_paths(::HasHelpers::Engine.root.join("spec/factories/shared"))

data/lib/has_helpers/rspec.rb

@@ -0,0 +1,22 @@
+# typed: false
+# frozen_string_literal: true
+
+require "rspec"
+
+# If other RSpec related code is needed then these matchers may be moved into a separate file.
+RSpec::Matchers.define :define_constant do |name|
+  match do |klass|
+    @key ||= name.constant_case
+    klass.const_defined?(@key) && klass.const_get(@key).name == name
+  end
+
+  chain :with_key do |key|
+    @key = key
+  end
+end
+
+RSpec::Matchers.define :have_total_constants do |expected_total|
+  match do |klass|
+    klass.all.size == expected_total && klass::ALL.size == expected_total
+  end
+end

data/lib/has_helpers/sentry/graphql_trace.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module HasHelpers
+  module Sentry
+    module GraphqlTrace
+      def set_graphql_trace!(controller_name:, operation_name:, query:, user_id:)
+        return if operation_name.nil? || operation_name.to_s.strip.empty?
+
+        transaction_name = "#{controller_name}/#{operation_name}"
+
+        return unless defined?(::Sentry) &&
+                      ::Sentry.respond_to?(:configure_scope) &&
+                      ::Sentry.respond_to?(:set_tags)
+
+        ::Sentry.configure_scope do |scope|
+          scope.set_transaction_name(transaction_name)
+          if user_id
+            scope.set_user(
+              id: user_id
+            )
+          end
+        end
+
+        ::Sentry.set_tags(
+          graphql_operation_name: operation_name,
+          graphql_operation_type: graphql_operation_type(query)
+        )
+      end
+
+      private
+
+      def graphql_operation_type(query)
+        query.to_s[/\b(query|mutation|subscription)\b/, 1]
+      end
+    end
+  end
+end

data/lib/has_helpers/serializer.rb

@@ -0,0 +1,41 @@
+# typed: true
+# frozen_string_literal: true
+
+module HasHelpers::Serializer
+  # Serializes ActiveRecord objects, denormalizing constants.
+  #
+  #=== Example
+  # ::HQ::Serializer.serialize(person)
+  # => {
+  #   first_name: "Joe"
+  #   last_name: "Smith"
+  #   status: "Active" # constant association
+  # }
+  def self.serialize(record)
+    record.attributes.reject { |key, _value| constant_foreign_keys(record.class).include?(key) }.merge(constant_attributes(record))
+  end
+
+  def self.serialize_array(array)
+    array.map { |record| serialize(record) }
+  end
+
+  class << self
+    private
+
+    # Returns all associations for an ActiveRecord Model class that are HQ Constants.
+    def constant_associations(klass)
+      @constant_associations ||= {}
+      @constant_associations[klass.name] ||= ::HQ::Resource.new(klass).constant_associations
+    end
+
+    # Returns all associations for an ActiveRecord Model class that are HQ Constants.
+    def constant_foreign_keys(klass)
+      @constant_foreign_keys ||= {}
+      @constant_foreign_keys[klass.name] ||= constant_associations(klass).map(&:foreign_key)
+    end
+
+    def constant_attributes(record)
+      constant_associations(record.class).map { |association| [association.name, record.send(association.name).try(&:name)] }.to_h.stringify_keys
+    end
+  end
+end

data/lib/has_helpers/service_trust/audit.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module HasHelpers
+  module ServiceTrust
+    class Audit
+      class << self
+        def record!(payload: {}, header: {}, outcome:, rejection_reason: nil, request: nil, expected_audience: nil, capabilities: nil, direction: "inbound")
+          attributes = {
+            issuer: payload["iss"] || "unknown",
+            audience: payload["aud"] || expected_audience || "unknown",
+            subject: payload["sub"],
+            jti: payload["jti"],
+            kid: header["kid"],
+            outcome: outcome.to_s,
+            rejection_reason: rejection_reason,
+            remote_ip: request&.ip,
+            user_agent: request&.user_agent,
+            token_iat: epoch_time(payload["iat"]),
+            token_exp: epoch_time(payload["exp"]),
+            occurred_at: Time.current,
+            direction: direction.to_s,
+            capabilities: Capability.parse(capabilities).join(" ").presence
+          }
+
+          if HasHelpers::ServiceTrust.config.audit_async
+            HasHelpers::ServiceTrust::AuditLog::WriteJob.perform_later(attributes)
+          else
+            HasHelpers::ServiceTrust::AuditLog.create!(attributes)
+          end
+        rescue StandardError => e
+          Rails.logger.error("ServiceTrust audit write failed: #{e.class}: #{e.message}") if defined?(Rails) && Rails.respond_to?(:logger) && Rails.logger
+          nil
+        end
+
+        private
+
+        def epoch_time(value)
+          return nil if value.blank?
+
+          Time.zone ? Time.zone.at(value.to_i) : Time.at(value.to_i).utc
+        end
+      end
+    end
+  end
+end

data/lib/has_helpers/service_trust/authorization.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module HasHelpers
+  module ServiceTrust
+    module Authorization
+      module_function
+
+      def require!(token_context, capability:)
+        return if capability == :none
+        raise ArgumentError, "capability required" if capability.blank?
+
+        caps = capabilities_from(token_context)
+        return if Capability.includes?(caps, capability)
+
+        raise InsufficientCapabilityError, "missing capability: #{capability}"
+      end
+
+      def require_any!(token_context, capabilities:)
+        caps = capabilities_from(token_context)
+        return if Capability.any_match?(caps, capabilities)
+
+        raise InsufficientCapabilityError, "missing any capability of: #{Array(capabilities).join(', ')}"
+      end
+
+      def capabilities_from(token_context)
+        return token_context[:capabilities] if token_context.is_a?(Hash) && token_context[:capabilities]
+        return token_context["capabilities"] if token_context.is_a?(Hash) && token_context["capabilities"]
+        return token_context["_capabilities"] if token_context.is_a?(Hash) && token_context["_capabilities"]
+
+        []
+      end
+    end
+  end
+end

data/lib/has_helpers/service_trust/bearer_token.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module HasHelpers
+  module ServiceTrust
+    module BearerToken
+      PATTERN = /\ABearer\s+(.+)\z/
+
+      module_function
+
+      def extract!(authorization_header)
+        match = authorization_header.to_s.match(PATTERN)
+        raise InvalidTokenError, "missing bearer token" unless match
+
+        match[1]
+      end
+
+      def apply!(request, headers)
+        headers.each { |key, value| request[key] = value }
+        request
+      end
+    end
+  end
+end