has_helpers 5.0.2

data/lib/has_helpers/service_trust/key_manager.rb

@@ -0,0 +1,160 @@
+# frozen_string_literal: true
+
+require "openssl"
+require "securerandom"
+require "monitor"
+
+module HasHelpers
+  module ServiceTrust
+    class KeyManager
+      ADVISORY_LOCK_KEY = 8_472_901
+      EnvKey = Struct.new(:kid, :environment, :private_key_pem, :public_key_pem, :algorithm, :active, keyword_init: true) do
+        def to_openssl
+          OpenSSL::PKey.read(private_key_pem)
+        end
+
+        def public_key
+          OpenSSL::PKey.read(public_key_pem)
+        end
+
+        def id
+          nil
+        end
+
+        def persisted?
+          false
+        end
+      end
+
+      class << self
+        def current_signing_key
+          cache.synchronize do
+            @current_signing_key ||= load_from_env || load_or_generate_from_db
+            raise_if_env_mismatch!(@current_signing_key)
+            @current_signing_key
+          end
+        end
+
+        def verifiable_keys
+          current = current_signing_key
+          db_keys = defined?(HasHelpers::ServiceTrust::Key) ? HasHelpers::ServiceTrust::Key.verifiable_for_env(env).to_a : []
+          ([current] + db_keys.reject { |key| same_key?(key, current) }).uniq(&:kid)
+        end
+
+        def rotate!(verifiable_for: 1.hour)
+          raise ConfigurationError, "cannot rotate ENV-backed ServiceTrust keys" if load_from_env
+
+          HasHelpers::ServiceTrust::Key.transaction do
+            with_advisory_lock do
+              old = HasHelpers::ServiceTrust::Key.active_for_env(env).first
+              keypair = generate_keypair
+              # retired_at is set to a FUTURE timestamp so the key stays in JWKS
+              # (verifiable_for_env scope keeps rows where retired_at IS NULL OR retired_at > NOW)
+              # until the rotation overlap window elapses.
+              old&.update!(active: false, verifiable_until: Time.current + verifiable_for, retired_at: Time.current + verifiable_for)
+              new_key = HasHelpers::ServiceTrust::Key.create!(
+                environment: env,
+                kid: new_kid,
+                public_key_pem: keypair.public_key.to_pem,
+                private_key_pem: keypair.to_pem,
+                algorithm: "RS256",
+                active: true
+              )
+              invalidate_cache!
+              new_key
+            end
+          end
+        end
+
+        def generate_first_key!
+          load_or_generate_from_db
+        end
+
+        def retire!(kid)
+          HasHelpers::ServiceTrust::Key.for_env(env).find_by!(kid: kid).update!(active: false, retired_at: Time.current, verifiable_until: Time.current)
+          invalidate_cache!
+        end
+
+        def invalidate_cache!
+          cache.synchronize { @current_signing_key = nil }
+        end
+
+        def env
+          HasHelpers::ServiceTrust.config.environment.to_s
+        end
+
+        def generate_keypair
+          OpenSSL::PKey::RSA.generate(2048)
+        end
+
+        private
+
+        def load_from_env
+          config = HasHelpers::ServiceTrust.config
+          private_key = ENV[config.private_key_env]
+          kid = ENV[config.kid_env]
+          key_env = ENV[config.key_environment_env]
+          return nil if private_key.blank? && kid.blank? && key_env.blank?
+          raise ConfigurationError, "ENV-mode requires #{config.private_key_env}, #{config.kid_env}, and #{config.key_environment_env}" if private_key.blank? || kid.blank? || key_env.blank?
+          raise ConfigurationError, "ServiceTrust ENV key is bound to '#{key_env}' but running in '#{env}'" if key_env.to_s != env
+
+          pkey = OpenSSL::PKey.read(private_key)
+          EnvKey.new(
+            kid: kid,
+            environment: key_env.to_s,
+            private_key_pem: private_key,
+            public_key_pem: pkey.public_key.to_pem,
+            algorithm: "RS256",
+            active: true
+          )
+        end
+
+        def load_or_generate_from_db
+          HasHelpers::ServiceTrust::Key.active_for_env(env).first || generate_from_db
+        end
+
+        def generate_from_db
+          HasHelpers::ServiceTrust::Key.transaction do
+            with_advisory_lock do
+              existing = HasHelpers::ServiceTrust::Key.active_for_env(env).first
+              return existing if existing
+
+              keypair = generate_keypair
+              HasHelpers::ServiceTrust::Key.create!(
+                environment: env,
+                kid: new_kid,
+                public_key_pem: keypair.public_key.to_pem,
+                private_key_pem: keypair.to_pem,
+                algorithm: "RS256",
+                active: true
+              )
+            end
+          end
+        end
+
+        def with_advisory_lock
+          HasHelpers::ServiceTrust::Key.connection.execute("SELECT pg_advisory_xact_lock(#{ADVISORY_LOCK_KEY})")
+          yield
+        end
+
+        def raise_if_env_mismatch!(key)
+          return if key.environment.to_s == env
+
+          raise ConfigurationError, "ServiceTrust key environment mismatch"
+        end
+
+        def new_kid
+          "#{env}-#{SecureRandom.hex(16)}"
+        end
+
+        def same_key?(left, right)
+          left.kid == right.kid && left.environment == right.environment
+        end
+
+        def cache
+          @cache ||= Monitor.new
+        end
+      end
+    end
+  end
+end

data/lib/has_helpers/service_trust/rate_limiter.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module HasHelpers
+  module ServiceTrust
+    class RateLimiter
+      class << self
+        def check!(issuer)
+          limit = HasHelpers::ServiceTrust.config.rate_limit_per_issuer
+          requests = limit.fetch(:requests).to_i
+          period = limit.fetch(:per).to_i
+          key = "service_trust:rate:#{issuer}:#{Time.current.to_i / period}"
+          count = redis.incr(key)
+          redis.expire(key, period) if count == 1
+          raise RateLimitedError, "issuer rate limit exceeded" if count > requests
+
+          true
+        end
+
+        private
+
+        def redis
+          HasHelpers::ServiceTrust.config.replay_cache_redis.call
+        end
+      end
+    end
+  end
+end

data/lib/has_helpers/service_trust/replay_cache.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module HasHelpers
+  module ServiceTrust
+    class ReplayCache
+      class << self
+        def claim!(jti, ttl:)
+          raise InvalidTokenError, "missing jti" if jti.blank?
+
+          ttl = ttl.to_i + HasHelpers::ServiceTrust.config.clock_skew.to_i
+          ttl = 1 if ttl < 1
+          result = redis.set("service_trust:jti:#{jti}", "1", nx: true, ex: ttl)
+          raise ReplayDetectedError, "token replay detected" unless result
+
+          true
+        end
+
+        private
+
+        def redis
+          HasHelpers::ServiceTrust.config.replay_cache_redis.call
+        end
+      end
+    end
+  end
+end

data/lib/has_helpers/service_trust/signer.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require "securerandom"
+
+module HasHelpers
+  module ServiceTrust
+    class Signer
+      class << self
+        def sign(audience:, subject: nil, capability: nil, ttl: HasHelpers::ServiceTrust.config.token_ttl)
+          raise ConfigurationError, "audience is required" if audience.blank?
+          raise ConfigurationError, "issuer is required" if config.issuer.blank?
+
+          key = KeyManager.current_signing_key
+          now = Time.current.to_i
+          payload = {
+            iss: config.issuer,
+            aud: audience,
+            sub: subject,
+            iat: now,
+            nbf: now,
+            exp: now + ttl.to_i,
+            jti: SecureRandom.uuid,
+            env: config.environment.to_s,
+            scope: capability_claim(capability)
+          }.compact
+
+          JwtCodec.encode(payload, key.to_openssl, key.kid, alg: key.algorithm)
+        end
+
+        def bearer_header(**opts)
+          { "Authorization" => "Bearer #{sign(**opts)}" }
+        end
+
+        private
+
+        def capability_claim(capability)
+          caps = Capability.parse(capability)
+          caps.empty? ? nil : caps.join(" ")
+        end
+
+        def config
+          HasHelpers::ServiceTrust.config
+        end
+      end
+    end
+  end
+end

data/lib/has_helpers/service_trust/test.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+module HasHelpers
+  module ServiceTrust
+    module Test
+      class << self
+        def stub_issuer(issuer, public_keys:)
+          raise ConfigurationError, "ServiceTrust::Test stubs are only available in test/development" unless test_or_development?
+
+          stubs[issuer.to_s] = public_keys
+        end
+
+        def public_key_for(issuer, kid)
+          return nil unless test_or_development?
+
+          keys = stubs[issuer.to_s]
+          return nil unless keys
+
+          key = keys.find { |candidate| candidate.respond_to?(:kid) ? candidate.kid == kid : candidate[:kid] == kid || candidate["kid"] == kid }
+          return nil unless key
+
+          extract_public_key(key)
+        end
+
+        def clear!
+          stubs.clear
+        end
+
+        def enabled?
+          test_or_development?
+        end
+
+        private
+
+        def extract_public_key(key)
+          if key.respond_to?(:public_key)
+            key.public_key
+          elsif key[:public_key]
+            key[:public_key]
+          elsif key["public_key"]
+            key["public_key"]
+          elsif key[:public_key_pem] || key["public_key_pem"]
+            OpenSSL::PKey.read(key[:public_key_pem] || key["public_key_pem"])
+          else
+            key
+          end
+        end
+
+        def test_or_development?
+          env = HasHelpers::ServiceTrust.config.environment.to_s
+          env == "test" || env == "development"
+        end
+
+        def stubs
+          @stubs ||= {}
+        end
+      end
+    end
+  end
+end

data/lib/has_helpers/service_trust/verifier.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+module HasHelpers
+  module ServiceTrust
+    class Verifier
+      REQUIRED_CLAIMS = %w[iss aud iat nbf exp jti env].freeze
+
+      Result = Struct.new(:claims, :capabilities, keyword_init: true) do
+        delegate :[], :dig, to: :claims
+
+        def to_h
+          claims
+        end
+      end
+
+      class << self
+        def verify!(token, expected_audience:, request: nil)
+          header = {}
+          payload = {}
+
+          begin
+            header, payload = JwtCodec.peek(token)
+            validate_untrusted_payload!(header, payload)
+            public_key = JwksClient.public_key_for(payload["iss"], header["kid"])
+            decoded = JwtCodec.decode!(token, public_key, alg: header["alg"])
+            validate_claims!(decoded, expected_audience)
+            RateLimiter.check!(decoded["iss"])
+            ReplayCache.claim!(decoded["jti"], ttl: decoded["exp"].to_i - Time.current.to_i)
+            capabilities = effective_capabilities(decoded)
+            Audit.record!(
+              payload: decoded,
+              header: header,
+              outcome: "accepted",
+              request: request,
+              expected_audience: expected_audience,
+              capabilities: capabilities,
+              direction: "inbound"
+            )
+            Result.new(claims: decoded, capabilities: capabilities)
+          rescue Error => e
+            Audit.record!(
+              payload: payload || {},
+              header: header || {},
+              outcome: "rejected",
+              rejection_reason: e.class.name.demodulize,
+              request: request,
+              expected_audience: expected_audience,
+              capabilities: nil,
+              direction: "inbound"
+            )
+            raise
+          end
+        end
+
+        private
+
+        def validate_untrusted_payload!(header, payload)
+          JwtCodec.assert_allowed_algorithm!(header["alg"])
+          missing = REQUIRED_CLAIMS.select { |claim| payload[claim].blank? }
+          raise InvalidTokenError, "missing required claims" if missing.any?
+          raise UntrustedIssuerError, "untrusted issuer" unless HasHelpers::ServiceTrust.config.trusted?(payload["iss"])
+        end
+
+        def validate_claims!(decoded, expected_audience)
+          raise AudienceMismatchError, "audience mismatch" unless decoded["aud"] == expected_audience
+          raise TokenExpiredError, "token ttl exceeds maximum" if decoded["exp"].to_i - decoded["iat"].to_i > config.max_token_ttl.to_i
+          raise TokenExpiredError, "token issued outside allowed window" if (Time.current.to_i - decoded["iat"].to_i).abs > config.max_token_ttl.to_i + config.clock_skew.to_i
+          raise InvalidTokenError, "environment mismatch" unless decoded["env"].to_s == config.environment.to_s
+        end
+
+        def effective_capabilities(decoded)
+          trusted = config.trusted_issuer(decoded["iss"])
+          Capability.effective(
+            token_caps: decoded["scope"],
+            allowed_caps: trusted&.allowed_capabilities || []
+          )
+        end
+
+        def config
+          HasHelpers::ServiceTrust.config
+        end
+      end
+    end
+  end
+end

data/lib/has_helpers/service_trust/verify_middleware.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module HasHelpers
+  module ServiceTrust
+    class VerifyMiddleware
+      STATUS_FOR_ERROR = {
+        TLSRequiredError      => 400,
+        OutboundTLSError      => 502,
+        JwksUnavailableError  => 503,
+        InsufficientCapabilityError => 403
+      }.freeze
+
+      def initialize(app, paths: nil)
+        @app = app
+        @paths = paths
+      end
+
+      def call(env)
+        request = Rack::Request.new(env)
+        return @app.call(env) unless applies?(request)
+
+        enforce_tls!(request)
+        token = BearerToken.extract!(request.get_header("HTTP_AUTHORIZATION"))
+        result = Verifier.verify!(token, expected_audience: HasHelpers::ServiceTrust.config.issuer, request: request)
+        env["service_trust.token"] = result.claims
+        env["service_trust.capabilities"] = result.capabilities
+        env["service_trust.result"] = result
+        @app.call(env)
+      rescue Error => e
+        status = STATUS_FOR_ERROR.fetch(e.class, 401)
+        [status, { "Content-Type" => "application/json" }, [{ error: e.class.name.demodulize }.to_json]]
+      end
+
+      private
+
+      def applies?(request)
+        return true unless @paths
+
+        @paths.match?(request.path)
+      end
+
+      def enforce_tls!(request)
+        return if request.ssl?
+        return if dev_or_test?
+
+        raise TLSRequiredError, "HTTPS is required"
+      end
+
+      def dev_or_test?
+        env = HasHelpers::ServiceTrust.config.environment.to_s
+        env == "development" || env == "test"
+      end
+    end
+  end
+end

data/lib/has_helpers/service_trust.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require "active_support"
+require "active_support/core_ext/numeric/time"
+require "active_support/core_ext/object/blank"
+require "jwt"
+
+require "has_helpers/service_trust/configuration"
+require "has_helpers/service_trust/errors"
+require "has_helpers/service_trust/capability"
+require "has_helpers/service_trust/authorization"
+require "has_helpers/service_trust/engine"
+require "has_helpers/service_trust/key_manager"
+require "has_helpers/service_trust/jwt_codec"
+require "has_helpers/service_trust/bearer_token"
+require "has_helpers/service_trust/signer"
+require "has_helpers/service_trust/jwks_client"
+require "has_helpers/service_trust/replay_cache"
+require "has_helpers/service_trust/rate_limiter"
+require "has_helpers/service_trust/audit"
+require "has_helpers/service_trust/verifier"
+require "has_helpers/service_trust/verify_middleware"
+require "has_helpers/service_trust/client/response"
+require "has_helpers/service_trust/client/retry"
+require "has_helpers/service_trust/client"
+require "has_helpers/service_trust/graphql_client"
+require "has_helpers/service_trust/graphql/authorizable"
+require "has_helpers/service_trust/test"
+require_relative "../../app/controllers/has_helpers/service_trust/jwks_controller"
+require_relative "../../app/controllers/concerns/has_helpers/service_trust/graphql_authentication"
+
+module HasHelpers
+  module ServiceTrust
+    class << self
+      def config
+        @config ||= Configuration.new
+      end
+
+      def configure
+        yield config
+      end
+
+      def reset_configuration!
+        @config = Configuration.new
+        KeyManager.invalidate_cache! if defined?(KeyManager)
+        JwksClient.clear_cache! if defined?(JwksClient)
+        Test.clear! if defined?(Test)
+      end
+    end
+  end
+end

data/lib/has_helpers/test_helpers/factory_data/unit_addresses.rb

@@ -0,0 +1,42 @@
+# typed: false
+# frozen_string_literal: true
+
+FactoryData.preload(:unit_addresses, model_class: Address) do |data|
+  ###### filters ######
+
+  ###### globals ######
+
+  ###### associations ######
+
+  ###### validations ######
+
+  ###### security ######
+
+  ###### scopes ######
+  @organization = organization_factory
+  data.add(:other) { FactoryGirl.create(:address, organization: @organization, location: Address::OTHER_LOCATION, is_primary: false) }
+  data.add(:office) { FactoryGirl.create(:address, organization: @organization, location: Address::OFFICE_LOCATION, is_primary: false) }
+
+  ###### indexes ######
+
+  ###### class methods ######
+  @organization = organization_factory
+  data.add(:not_favorite) { FactoryGirl.create(:address, organization: @organization, location: Address::OFFICE_LOCATION, is_primary: false) }
+
+  ###### instance methods ######
+  data.add(:display_address) { FactoryGirl.create(:address, organization: organization_factory, is_primary: false) }
+
+  data.add(:display_zipcode) { FactoryGirl.create(:address, organization: organization_factory, is_primary: false) }
+
+  ###### normalizations ######
+  data.add(:normalization) { FactoryGirl.create(:address, organization: organization_factory, is_primary: false) }
+
+  ###### triggers ######
+  organization = organization_factory
+  advisor = FactoryGirl.build(:advisor, organization: organization)
+  advisor.person = FactoryGirl.build(:person, organization: organization, created_by: organization.users.shuffle.first, updated_by: organization.users.shuffle.first)
+  advisor.addresses << FactoryGirl.build(:address, is_primary: true)
+  advisor.save!
+  advisor.reload
+  data.add(:only_one_primary) { advisor.addresses.shuffle.first }
+end