booth 0.0.10 → 0.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '0280f442ad970037bc59f8ec9f200b78638e3b32fc5f3135623d7cd69a8b8afc'
-  data.tar.gz: f0f98d84ebd59fac0ecd212d072cbe8d5960570af0ff99e1c723c4d1d74dc3f7
+  metadata.gz: 825454f7f3a05334b3fa0ae5dffa808debf032381a9eca3ecc33c328cd686d30
+  data.tar.gz: 961e43f55afaa1a41ac5234f56a8848016e89a0d3d5f2a4a3f4a992434894bad
 SHA512:
-  metadata.gz: 5315f7ccaddb530588cbdfe5c0dd57919240e62f1378bfd54f66b96acf93c8e9cbdd31fed75bcecbca23a39fea33356dc486c4e55314a21e8248551eb819ea0a
-  data.tar.gz: 5dbdb5999e95666b64acea7cb403d7c7dd93919929a9fb89ae9b7c42d5206a40c94e4f8226cb43395f835dde5561f37c82fc003dd551f8cef81d84bee974aa10
+  metadata.gz: dfd4cfc102db64fcc7d5c5654565928c095d0075ca743a8bc2ac1ade00e347b4342580a00d4e755ca082f9762f921de3f8405ed55dc8eaa5e86ff85214094207
+  data.tar.gz: ca078c52a93db8f77d6c46e48c81cee5ca34228606ed72bdad3b0156dc677df5979d367fb47b9f17796cb441449541c49494dff193f0217418861c25a982e4d3

data/CHANGELOG.md

@@ -2,7 +2,22 @@
 
 # 0.0.10
 
-- Make Adminland.start_incognito work cross-domain
+- Schema: add `booth_sessions.incognito_secret_key` (string, unique) and `booth_sessions.impersonator_session_id` (uuid, FK to self)
+
+  ### Upgrading: Add new columns via migration
+
+  ```ruby
+  class AddIncognitoColumnsToBoothSessions < ActiveRecord::Migration[8.1]
+    def change
+      add_column :booth_sessions, :incognito_secret_key, :string
+      add_index :booth_sessions, :incognito_secret_key, unique: true
+
+      add_reference :booth_sessions, :impersonator_session,
+                    foreign_key: { to_table: :booth_sessions, on_delete: :nullify },
+                    type: :uuid, index: true
+    end
+  end
+  ```
 
 # 0.0.9
 

data/config/locales/de.yml

@@ -22,6 +22,15 @@ de:
     email_too_long: The provided email is too long. It must be less at most %{maximum} characters long.
     email_too_short: The provided email is too short. It should be at least %{minimum} characters long.
     incognito_started: Sie sind jetzt im Namen eines anderen Kontos angemeldet.
+    incognito_token_issued: Der Inkognito-Schlüssel wurde ausgestellt.
+    incognito_token_expired: Der Inkognito-Schlüssel ist abgelaufen. Bitte stellen Sie einen neuen aus.
+    incognito_session_not_found: Der Inkognito-Schlüssel ist ungültig.
+    incognito_stopped: Sie sind nicht länger im Namen eines anderen Kontos angemeldet.
+    already_logged_in_on_scope: Sie sind bereits angemeldet. Bitte melden Sie sich zuerst ab.
+    scope_mismatch: Der angegebene Bereich stimmt nicht mit dem Zielkonto überein.
+    not_logged_in: Sie müssen angemeldet sein, um diese Aktion auszuführen.
+    session_not_found: Ihre Sitzung konnte nicht gefunden werden.
+    impersonator_session_not_found: Die ursprüngliche Sitzung konnte nicht wiederhergestellt werden.
     incompatible_webauth_device: Sorry, this device cannot be used. Please try another webauth device.
     invalid_domain: Die Domain "%{domain}" ist keine gültige Domain.
     invalid_email_characters: The provided email address contains invalid characters.

data/config/locales/en.yml

@@ -22,6 +22,15 @@ en:
     email_too_long: The provided email is too long. It must be less at most %{maximum} characters long.
     email_too_short: The provided email is too short. It should be at least %{minimum} characters long.
     incognito_started: You are now acting on behalf of another account.
+    incognito_token_issued: The incognito token has been issued.
+    incognito_token_expired: The incognito token has expired. Please issue a new one.
+    incognito_session_not_found: The incognito token is invalid.
+    incognito_stopped: You are no longer acting on behalf of another account.
+    already_logged_in_on_scope: You are already logged in. Please log out first.
+    scope_mismatch: The provided scope does not match the target account.
+    not_logged_in: You must be logged in to perform this action.
+    session_not_found: Your session could not be found.
+    impersonator_session_not_found: The original session could not be restored.
     incompatible_webauth_device: Sorry, this device cannot be used. Please try another webauth device.
     invalid_domain: The Domain "%{domain}" is not a valid domain name.
     invalid_email_characters: The provided email address contains invalid characters.

data/lib/booth/adminland/incognitos/consume_token.rb

@@ -0,0 +1,108 @@
+# frozen_string_literal: true
+
+module Booth
+  module Adminland
+    module Incognitos
+      class ConsumeToken
+        include Calls
+        include ::Booth::Logging
+
+        option :scope, ::Booth::Coercers::Scope
+        option :request, ::Booth::Coercers::Request
+        option :secret_key
+
+        def call
+          do_find_session
+            .on_success { do_check_expiry }
+            .on_success { do_check_not_already_logged_in_as_someone_else }
+            .on_success { do_compare_scope }
+            .on_success { do_atomic_updates }
+            .on_success { do_audit }
+            .on_success { do_login }
+        end
+
+        private
+
+        attr_accessor :session
+
+        def do_find_session
+          self.session = ::Booth::Models::Session.find_by(incognito_secret_key: secret_key)
+
+          return Tron.failure(:incognito_session_not_found,
+                              public_message: I18n.t('booth.incognito_session_not_found')) unless session
+
+          log { "Found session ##{session.id}" }
+          Tron.success :session_found
+        end
+
+        def do_check_expiry
+          return Tron.failure(:incognito_token_expired,
+                              public_message: I18n.t('booth.incognito_token_expired')) unless session.created_at > 60.seconds.ago
+
+          Tron.success :session_within_expiry
+        end
+
+        def do_check_not_already_logged_in_as_someone_else
+          if request.authentication.logged_in? &&
+             request.authentication.credential_id != session.incognito_credential_id
+            log { 'Someone else is logged in on this scope' }
+            return Tron.failure :already_logged_in_on_scope,
+                                public_message: I18n.t('booth.already_logged_in_on_scope')
+          end
+
+          Tron.success :not_logged_in_or_is_impersonator
+        end
+
+        def do_compare_scope
+          return Tron.failure(:scope_mismatch,
+                              public_message: I18n.t('booth.scope_mismatch')) unless session.credential.scope == scope.to_s
+
+          Tron.success :scope_matches
+        end
+
+        def do_atomic_updates
+          ::Booth::Models::Session.transaction do
+            session.update!(incognito_secret_key: nil)
+            log { 'Cleared incognito_secret_key' }
+            revoke_impersonator_if_same_scope
+            session.update!(agent: request.agent, most_recent_ip: request.ip)
+          end
+
+          Tron.success :atomic_updates_done
+        end
+
+        def do_audit
+          ::Booth::Models::Audit.create!(
+            credential_id: session.incognito_credential_id,
+            ip: request.ip,
+            agent: request.agent,
+            event: :incognito_consumed,
+          )
+
+          Tron.success :audited
+        end
+
+        def do_login
+          request.authentication.login(session:)
+          Tron.success :incognito_started,
+                       public_message: I18n.t('booth.incognito_started')
+        end
+
+        def revoke_impersonator_if_same_scope
+          return unless request.authentication.logged_in? &&
+                        request.authentication.credential_id == session.incognito_credential_id
+
+          impersonator_session = ::Booth::Models::Session.find_by(
+            id: request.authentication.session_id,
+          )
+
+          return unless impersonator_session
+
+          log { "Revoking impersonator session ##{impersonator_session.id}" }
+          impersonator_session.update!(revoked_at: Time.current, revoke_reason: :impersonation)
+          session.update!(impersonator_session_id: impersonator_session.id)
+        end
+      end
+    end
+  end
+end

data/lib/booth/adminland/incognitos/generate_secret_key.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+module Booth
+  module Adminland
+    module Incognitos
+      class GenerateSecretKey
+        include Calls
+        include ::Booth::Logging
+
+        option :scope, ::Booth::Coercers::Scope
+        option :request, ::Booth::Coercers::Request
+        option :target_credential_id
+
+        def call
+          do_check_impersonator_logged_in
+            .on_success { do_find_target_credential }
+            .on_success { do_create_session }
+            .on_success { do_audit }
+            .on_success { do_return_key }
+        end
+
+        private
+
+        attr_accessor :impersonator_credential_id, :target_credential, :session, :secret_key
+
+        def do_check_impersonator_logged_in
+          return Tron.failure(:not_logged_in_as_impersonator,
+                              public_message: I18n.t('booth.not_logged_in_as_impersonator')) unless request.authentication.logged_in?
+
+          self.impersonator_credential_id = request.authentication.credential_id
+          log { "Impersonator credential_id=#{impersonator_credential_id}" }
+          Tron.success :impersonator_captured
+        end
+
+        def do_find_target_credential
+          self.target_credential = ::Booth::Models::Credential.find_by(id: target_credential_id)
+
+          return Tron.failure(:target_credential_not_found,
+                              public_message: I18n.t('booth.target_credential_not_found')) unless target_credential
+
+          log { "Target credential ##{target_credential.id} found" }
+          Tron.success :target_credential_found
+        end
+
+        def do_create_session
+          self.secret_key = SecureRandom.hex(32)
+
+          self.session = ::Booth::Models::Session.create!(
+            credential: target_credential,
+            incognito_credential_id: impersonator_credential_id,
+            incognito_secret_key: secret_key,
+            most_recent_ip: request.ip,
+          )
+
+          log { "Created incognito session ##{session.id}" }
+          Tron.success :session_created
+        end
+
+        def do_audit
+          ::Booth::Models::Audit.create!(
+            credential_id: impersonator_credential_id,
+            ip: request.ip,
+            agent: request.agent,
+            event: :incognito_token_issued,
+          )
+
+          Tron.success :audited
+        end
+
+        def do_return_key
+          Tron.success :incognito_token_issued,
+                       secret_key:,
+                       public_message: I18n.t('booth.incognito_token_issued')
+        end
+      end
+    end
+  end
+end

data/lib/booth/adminland/incognitos/stop_incognito.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+module Booth
+  module Adminland
+    module Incognitos
+      class StopIncognito
+        include Calls
+        include ::Booth::Logging
+
+        option :scope, ::Booth::Coercers::Scope
+        option :request, ::Booth::Coercers::Request
+
+        def call
+          do_check_logged_in
+            .on_success { do_find_current_session }
+            .on_success { do_find_impersonator_session }
+            .on_success { do_revoke_incognito }
+            .on_success { do_audit }
+            .on_success { impersonator_session ? do_restore_impersonator : do_logout }
+        end
+
+        private
+
+        attr_accessor :current_session, :impersonator_session
+
+        def do_check_logged_in
+          return Tron.failure(:not_logged_in,
+                              public_message: I18n.t('booth.not_logged_in')) unless request.authentication.logged_in?
+
+          Tron.success :logged_in
+        end
+
+        def do_find_current_session
+          self.current_session = ::Booth::Models::Session.find_by(
+            id: request.authentication.session_id,
+          )
+
+          return Tron.failure(:session_not_found,
+                              public_message: I18n.t('booth.session_not_found')) unless current_session
+
+          Tron.success :current_session_found
+        end
+
+        def do_find_impersonator_session
+          return Tron.success(:no_impersonator_session) unless current_session.impersonator_session_id
+
+          self.impersonator_session = ::Booth::Models::Session.find_by(
+            id: current_session.impersonator_session_id,
+          )
+
+          return Tron.failure(:impersonator_session_not_found,
+                              public_message: I18n.t('booth.impersonator_session_not_found')) unless impersonator_session
+
+          Tron.success :impersonator_session_found
+        end
+
+        def do_revoke_incognito
+          current_session.update!(revoked_at: Time.current, revoke_reason: :incognito_stopped)
+          Tron.success :incognito_revoked
+        end
+
+        def do_audit
+          ::Booth::Models::Audit.create!(
+            credential_id: current_session.incognito_credential_id,
+            ip: request.ip,
+            agent: request.agent,
+            event: :incognito_stopped,
+          )
+
+          Tron.success :audited
+        end
+
+        def do_restore_impersonator
+          impersonator_session.update!(revoked_at: nil, revoke_reason: nil)
+          request.authentication.login(session: impersonator_session)
+          Tron.success :incognito_stopped,
+                       public_message: I18n.t('booth.incognito_stopped')
+        end
+
+        def do_logout
+          request.authentication.logout
+          Tron.success :incognito_stopped,
+                       public_message: I18n.t('booth.incognito_stopped')
+        end
+      end
+    end
+  end
+end

data/lib/booth/adminland.rb

@@ -48,8 +48,16 @@ module Booth
     # Incognito Helpers
     # -----------------
 
-    def self.start_incognito(...)
-      ::Booth::Adminland::Incognitos::Start.call(...)
+    def self.generate_incognito_secret_key(...)
+      ::Booth::Adminland::Incognitos::GenerateSecretKey.call(...)
+    end
+
+    def self.consume_incognito_token(...)
+      ::Booth::Adminland::Incognitos::ConsumeToken.call(...)
+    end
+
+    def self.stop_incognito(...)
+      ::Booth::Adminland::Incognitos::StopIncognito.call(...)
     end
 
     # ----------------

data/lib/booth/models/audit.rb

@@ -9,6 +9,9 @@ module Booth
       # changed_tenant (payload from: to:)
       enum :event, %i[
         completed_onboarding
+        incognito_consumed
+        incognito_stopped
+        incognito_token_issued
         logout
         registered
       ].index_with(&:to_s), prefix: true

data/lib/booth/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Booth
-  VERSION = '0.0.10'
+  VERSION = '0.1.0'
 end

data/lib/generators/booth/migration/templates/create_booth_tables.erb

@@ -74,6 +74,8 @@ class CreateBoothTables < ActiveRecord::Migration[<%= ActiveRecord::Migration.cu
       t.string :agent
       t.string :location
       t.hstore :historical_locations, null: false, default: {}
+      t.string :incognito_secret_key, index: { unique: true }
+      t.references :impersonator_session, foreign_key: { to_table: :booth_sessions, on_delete: :nullify }, type: :uuid, index: true
       t.timestamps
     end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: booth
 version: !ruby/object:Gem::Version
-  version: 0.0.10
+  version: 0.1.0
 platform: ruby
 authors:
 - halo
@@ -230,7 +230,9 @@ files:
 - lib/booth/adminland/authenticators/exist.rb
 - lib/booth/adminland/credentials/create.rb
 - lib/booth/adminland/credentials/index.rb
-- lib/booth/adminland/incognitos/start.rb
+- lib/booth/adminland/incognitos/consume_token.rb
+- lib/booth/adminland/incognitos/generate_secret_key.rb
+- lib/booth/adminland/incognitos/stop_incognito.rb
 - lib/booth/adminland/onboardings/create.rb
 - lib/booth/adminland/onboardings/destroy.rb
 - lib/booth/adminland/onboardings/find.rb

data/lib/booth/adminland/incognitos/start.rb

@@ -1,106 +0,0 @@
-# frozen_string_literal: true
-
-module Booth
-  module Adminland
-    module Incognitos
-      # The admin (impersonator) specifies their own +scope+ and a +target_scope+.
-      # +request+ is coerced with the impersonator's +scope+ (+request.authentication+ checks the
-      # impersonator's scope). We create a new session for the target credential and store the
-      # impersonator's credential_id as +incognito_credential_id+. If +target_scope+ matches the
-      # impersonator's scope, we revoke the impersonator's session before logging in as the target.
-      class Start
-        include Calls
-        include ::Booth::Logging
-
-        option :scope, ::Booth::Coercers::Scope
-        option :request, ::Booth::Coercers::Request
-        option :target_credential_id
-        option :target_scope
-
-        def call
-          do_check_impersonator_logged_in
-            .on_success { do_find_target_credential }
-            .on_success { do_compare_scope }
-            .on_success { do_create_session }
-            .on_success { do_revoke_impersonator_if_same_scope }
-            .on_success { do_login }
-        end
-
-        private
-
-        attr_accessor :impersonator_credential_id, :target_credential, :session
-
-        def do_check_impersonator_logged_in
-          unless request.authentication.logged_in?
-            log { 'No impersonator logged in' }
-            return Tron.failure :not_logged_in_as_impersonator,
-                                public_message: I18n.t('booth.not_logged_in_as_impersonator')
-          end
-
-          self.impersonator_credential_id = request.authentication.credential_id
-          log { "Impersonator credential_id=#{impersonator_credential_id}" }
-          Tron.success :impersonator_captured
-        end
-
-        def do_find_target_credential
-          self.target_credential = ::Booth::Models::Credential.find_by(id: target_credential_id)
-
-          if target_credential
-            log { "Target credential ##{target_credential.id} found" }
-            Tron.success :target_credential_found
-          else
-            Tron.failure :target_credential_not_found,
-                         public_message: I18n.t('booth.target_credential_not_found')
-          end
-        end
-
-        def do_compare_scope
-          ::Booth::Comparisons::Scope.call(
-            expected: target_credential.scope,
-            actual: target_scope,
-          )
-        end
-
-        def do_create_session
-          self.session = ::Booth::Models::Session.create!(
-            credential: target_credential,
-            incognito_credential_id: impersonator_credential_id,
-            agent: request.agent,
-            most_recent_ip: request.ip,
-          )
-          log { "Created incognito session ##{session.id}" }
-          Tron.success :session_created
-        end
-
-        def do_revoke_impersonator_if_same_scope
-          return Tron.success(:no_revoke_needed) unless same_scope?
-
-          impersonator_session = ::Booth::Models::Session.find_by(
-            id: request.authentication.session_id,
-          )
-          return Tron.failure(:impersonator_session_not_found) unless impersonator_session
-
-          log { "Revoking impersonator session ##{impersonator_session.id}" }
-          impersonator_session.update!(revoked_at: Time.current, revoke_reason: :impersonation)
-
-          Tron.success :impersonator_session_revoked
-        end
-
-        def do_login
-          target_auth.login(session:)
-          log { "Incognito started: #{target_credential.username}" }
-          Tron.success :incognito_started,
-                       public_message: I18n.t('booth.incognito_started')
-        end
-
-        def same_scope?
-          target_scope == request.scope
-        end
-
-        def target_auth
-          @target_auth ||= request.authentication(scope: target_scope)
-        end
-      end
-    end
-  end
-end