Class: Insika::Commands::RotateTenantToken

Inherits:
Object
  • Object
show all
Defined in:
lib/insika/commands/rotate_tenant_token.rb

Overview

WS1: rotates a tenant's credential — revokes every active token of the tenant and issues a fresh one, in ONE transaction (a crashed half-rotation must never leave the tenant with nothing valid). Only the tenant's own tokens are touched; the operator token and other tenants are untouched. -> { revoked: n, token: Issue.to_h }.

Instance Method Summary collapse

Constructor Details

#initialize(token_store:, event_stream:) ⇒ RotateTenantToken

Returns a new instance of RotateTenantToken.



11
12
13
14
 
# File 'lib/insika/commands/rotate_tenant_token.rb', line 11

def initialize(token_store:, event_stream:)
  @token_store = token_store
  @event_stream = event_stream
end

Instance Method Details

#call(command) ⇒ Object

Raises:



16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
 
# File 'lib/insika/commands/rotate_tenant_token.rb', line 16

def call(command)
  raise Insika::ValidationError, "token commands are operator-only" if command.meta[:tenant]

  tenant_id = Insika::Coercion.presence(
    command.payload[:tenant_id] || command.payload["tenant_id"]
  )
  raise Insika::ValidationError, "tenant_id is required" if tenant_id.nil?

  label = command.payload[:label] || command.payload["label"] || "default"
  result = @token_store.rotate(tenant_id: tenant_id, label: label)
  issue = result[:issue]
  emit(issue.id, tenant_id, result[:revoked])
  { revoked: result[:revoked],
    token: { token: issue.token, id: issue.id, tenant_id: tenant_id, label: label.to_s } }
end