Class: CommandTower::Workflows::Impersonation::StartWorkflow

Inherits:
ApplicationWorkflow show all
Defined in:
app/workflows/command_tower/workflows/impersonation/start_workflow.rb

Constant Summary

Constants inherited from ApplicationWorkflow

ApplicationWorkflow::ALLOWED_RETRY_STRATEGIES, ApplicationWorkflow::InvalidTransactionResult, ApplicationWorkflow::TransactionFailure

Instance Method Summary collapse

Methods inherited from ApplicationWorkflow

call, call_from_job, continuation_max_attempts, declared_retry_strategy, mark_impersonation_activity!, retry_strategy, validate_retry_strategy!

Methods included from Impersonation::ActivityDeclaration

included

Methods included from Logging::LifecycleDeclaration

included

Methods included from Execution::ContextAccess

#audit, #execution_context, #log_debug, #log_error, #log_info, #log_warn, #publish_event

Methods included from Transactional

#fail_transaction!, #transaction

Instance Method Details

#call(id:, actor:, scope_value: nil) ⇒ Object 



9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
 
# File 'app/workflows/command_tower/workflows/impersonation/start_workflow.rb', line 9

def call(id:, actor:, scope_value: nil)
  if CommandTower::Current.impersonation_active
    return failure(
      errors: [CommandTower::Errors::Auth::NestedImpersonationError.new],
      http_status: :forbidden
    )
  end

  if actor.id == id
    return failure(
      errors: [CommandTower::Errors::Auth::SelfImpersonationError.new],
      http_status: :unprocessable_entity
    )
  end

  scope_result = CommandTower::Workflows::Admin::ScopeResolution.resolve(
    tool_id: "users",
    user: actor,
    scope_value:
  )
  return scope_result if scope_result.is_a?(CommandTower::Workflows::WorkflowResult)

  shown = CommandTower::Services::Admin::Users::Show.call(
    id:,
    principal: actor,
    scope_context: scope_result
  )
  unless shown.success?
    return failure(
      errors: shown.errors,
      http_status: CommandTower::Workflows::Admin::Users::ErrorMapping.http_status_for(shown.errors.first)
    )
  end

  target = shown.data[:user]
  created = CommandTower::Services::Impersonation::Create.call(actor:, target:)
  unless created.success?
    return failure(
      errors: created.errors,
      http_status: :internal_server_error
    )
  end

  session = created.data[:session]
  audit_started(session:, target:, scope_context: scope_result)

  token = CommandTower::Jwt::LoginCreate.call(
    user: actor,
    impersonation_session_id: session.id
  ).token
  expires_at = CommandTower.config.jwt.ttl.from_now.to_time.to_s

  success(
    payload: CommandTower::Serializers::Impersonation::SessionSerializer.serialize(session),
    http_status: :created,
    response_effects: {
      set_token: { token:, expires_at: }
    }
  )
end