Class: Insika::Commands::IssueTenantToken

Inherits:
Object
  • Object
show all
Defined in:
lib/insika/commands/issue_tenant_token.rb

Overview

WS1: issues a PER-TENANT token (multi_tenant mode). Operator-only BY CONSTRUCTION: the edge refuses a tenant principal on POST /v1/commands (403), and an internal command stamped with a tenant is refused here — a tenant can never mint credentials. The plaintext token is the response and exists nowhere else; the store keeps only its hash. -> Issue.to_h.

Instance Method Summary collapse

Constructor Details

#initialize(token_store:, event_stream:) ⇒ IssueTenantToken

Returns a new instance of IssueTenantToken.



11
12
13
14
 
# File 'lib/insika/commands/issue_tenant_token.rb', line 11

def initialize(token_store:, event_stream:)
  @token_store = token_store
  @event_stream = event_stream
end

Instance Method Details

#call(command) ⇒ Object

Raises:



16
17
18
19
20
21
22
23
24
25
26
27
28
 
# File 'lib/insika/commands/issue_tenant_token.rb', line 16

def call(command)
  raise Insika::ValidationError, "token commands are operator-only" if command.meta[:tenant]

  tenant_id = Insika::Coercion.presence(
    command.payload[:tenant_id] || command.payload["tenant_id"]
  )
  raise Insika::ValidationError, "tenant_id is required" if tenant_id.nil?

  label = command.payload[:label] || command.payload["label"] || "default"
  issue = @token_store.issue(tenant_id: tenant_id, label: label)
  emit(issue.id, tenant_id)
  { token: issue.token, id: issue.id, tenant_id: tenant_id, label: label.to_s }
end