himari 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3ac0941b925171e38c0862b97f8a0ad2256c9ac56cfc3d3dd9b59bca1508dc4e
-  data.tar.gz: 37b2fc9399deca00071f07140c53aac84a8deb6169c9cb11f919d34388dae217
+  metadata.gz: 9ef5f3bac5f8a375751669378420729ab8dbe9ce40c1e1dec0fb5a3ac938b304
+  data.tar.gz: ed87e0922bc863813624c34d217f02fd9f06fec442fd01a8b0c1daf760b6ca48
 SHA512:
-  metadata.gz: c0513156a600ffe7a0364ab2c7da45153702afce8c0fd82caf2c6f697529793570f61280abe50316ae5dd491c49908a084fe8d8341ef0a8882a4c5fee5eaf954
-  data.tar.gz: 5b63f0a995ebc2be40440d02831c2bbb40d8928277b3e181ffc0d227546274af0d6fee26f26f4cea9dd90578095b8023c9830973e5d39205273e4a1c7f2633d0
+  metadata.gz: 97c69604496c88d5b6e0f38cf0693cdd07ee6dd15b73d12e724efcea058a2f44492fcbe57ed5ece878f36e7bc2631a028c1464f9bc17d33f519eb2f17b8ff576
+  data.tar.gz: 3a9fff6c67bec527df79527f9e436c5703d95e822e0b0d3bc4cc460e003205d238a9e8ea965f2fbb931a18389282dfa2b770e60b931eaadc82dd683b413f841a

data/lib/himari/app.rb

@@ -127,6 +127,7 @@ module Himari
         authz = AuthorizationCode.make(
           client_id: decision.client.id,
           claims: decision.claims,
+          lifetime: decision.lifetime,
         )
 
         Himari::Services::OidcAuthorizationEndpoint.new(
@@ -141,7 +142,20 @@ module Himari
       end
     rescue Himari::Services::DownstreamAuthorization::ForbiddenError => e
       logger&.warn(Himari::LogLine.new('authorize: downstream forbidden', req: request_as_log, allowed: e.result.authz_result.allowed, err: e.class.inspect, result: e.as_log))
-      halt 403, "Forbidden"
+
+      @notice = message_human = e.result.authz_result&.user_facing_message
+
+      case e.result.authz_result&.suggestion
+      when nil
+        # do nothing
+      when :reauthenticate
+        logger&.warn(Himari::LogLine.new('authorize: prompt login to reauthenticate', req: request_as_log, allowed: e.result.authz_result.allowed, err: e.class.inspect, result: e.as_log))
+        next erb(:login)
+      else
+        raise ArgumentError, "Unknown suggestion value for DownstreamAuthorization denial; #{e.as_log.inspect}"
+      end
+
+      halt(403, "Forbidden#{message_human ? "; #{message_human}" : nil}")
     end
 
     token_ep = proc do
@@ -182,9 +196,12 @@ module Himari
     end
 
     omniauth_callback = proc do
+      authhash = request.env['omniauth.auth']
+      next halt(400, 'Bad Request') unless authhash
+
       # do upstream auth
       authn = Himari::Services::UpstreamAuthentication.from_request(request).perform
-      logger&.info(Himari::LogLine.new('authentication allowed', req: request_as_log, allowed: authn.authn_result.allowed, uid: request.env.fetch('omniauth.auth')[:uid], provider: request.env.fetch('omniauth.auth')[:provider], result: authn.as_log))
+      logger&.info(Himari::LogLine.new('authentication allowed', req: request_as_log, allowed: authn.authn_result.allowed, uid: authhash[:uid], provider: authhash[:provider], result: authn.as_log))
       raise unless authn.authn_result.allowed # sanity check
 
       given_back_to = request.env['omniauth.params']&.fetch('back_to', nil)
@@ -203,7 +220,8 @@ module Himari
       redirect back_to
     rescue Himari::Services::UpstreamAuthentication::UnauthorizedError => e
       logger&.warn(Himari::LogLine.new('authentication denied', req: request_as_log, err: e.class.inspect, allowed: e.result.authn_result.allowed, uid: request.env.fetch('omniauth.auth')[:uid], provider: request.env.fetch('omniauth.auth')[:provider], result: e.as_log))
-      halt(401, 'Unauthorized')
+      message_human = e.result.authn_result&.user_facing_message
+      halt(401, "Unauthorized#{message_human ? "; #{message_human}" : nil}")
     end
     get '/auth/:provider/callback', &omniauth_callback
     post '/auth/:provider/callback', &omniauth_callback

data/lib/himari/authorization_code.rb

@@ -10,17 +10,25 @@ module Himari
     nonce
     code_challenge
     code_challenge_method
+    created_at
+    lifetime
     expiry
   )
   AuthorizationCode = Struct.new(*authz_attrs, keyword_init: true) do
     def self.make(**kwargs)
       new(
         code: SecureRandom.urlsafe_base64(32),
-        expiry: Time.now.to_i + 900,
+        created_at: Time.now.to_i,
         **kwargs,
       )
     end
 
+    alias _expiry_raw expiry
+    private :_expiry_raw
+    def expiry
+      self._expiry_raw || (self.expiry = created_at + (lifetime || 900))
+    end
+
     def valid_redirect_uri?(given_uri)
       redirect_uri == given_uri
     end
@@ -59,6 +67,8 @@ module Himari
         claims: claims,
         nonce: nonce,
         openid: openid,
+        created_at: created_at.to_i,
+        lifetime: lifetime.to_i,
         expiry: expiry.to_i,
         pkce: pkce?,
         pkce_method: code_challenge_method,
@@ -76,6 +86,8 @@ module Himari
         nonce: nonce,
         code_challenge: code_challenge,
         code_challenge_method: code_challenge_method,
+        created_at: created_at.to_i,
+        lifetime: lifetime.to_i,
         expiry: expiry.to_i,
       }
     end

data/lib/himari/decisions/authorization.rb

@@ -19,14 +19,15 @@ module Himari
 
       allow_effects(:allow, :deny, :continue, :skip)
 
-      def initialize(claims: {}, allowed_claims: DEFAULT_ALLOWED_CLAIMS, lifetime: 3600 * 12)
+      def initialize(claims: {}, allowed_claims: DEFAULT_ALLOWED_CLAIMS, lifetime: 3600)
         super()
         @claims = claims
         @allowed_claims = allowed_claims
         @lifetime = lifetime
       end
 
-      attr_reader :claims, :allowed_claims, :lifetime
+      attr_reader :claims, :allowed_claims
+      attr_accessor :lifetime
 
       def to_evolve_args
         {
@@ -37,10 +38,10 @@ module Himari
       end
 
       def as_log
-        to_h.merge(claims: output, lifetime: @lifetime&.to_i)
+        to_h.merge(claims: output_claims, lifetime: @lifetime&.to_i)
       end
 
-      def output
+      def output_claims
         claims.select { |k,_v| allowed_claims.include?(k) }
       end
     end

data/lib/himari/decisions/base.rb

@@ -18,7 +18,7 @@ module Himari
         raise "#{self.class.name}.valid_effects is missing [BUG]" unless self.class.valid_effects
       end
 
-      attr_reader :effect, :effect_comment, :rule_name
+      attr_reader :effect, :effect_comment, :effect_user_facing_message, :effect_suggestion, :rule_name
 
       def to_evolve_args
         raise NotImplementedError
@@ -29,7 +29,10 @@ module Himari
           rule_name: rule_name,
           effect: effect,
           effect_comment: effect_comment,
-        }
+        }.tap do |x|
+          x[:effect_user_facing_message] = effect_user_facing_message if effect_user_facing_message
+          x[:effect_suggestion] = effect_suggestion if effect_suggestion
+        end
       end
 
       def as_log
@@ -46,18 +49,21 @@ module Himari
         self
       end
 
-      def decide!(effect, comment = "")
+      def decide!(effect, comment = "", user_facing_message: nil, suggest: nil)
         raise DecisionAlreadyMade, "decision can only be made once per rule (#{rule_name})" if @effect
         raise InvalidEffect, "this effect is not valid under this rule. Valid effects: #{self.class.valid_effects.inspect} (#{rule_name})" unless self.class.valid_effects.include?(effect)
+        raise InvalidEffect, "only deny effect can have suggestion" if suggest&& effect != :deny
         @effect = effect
         @effect_comment = comment
+        @effect_user_facing_message = user_facing_message
+        @effect_suggestion = suggest
         nil
       end
 
-      def allow!(comment = ""); decide!(:allow, comment); end
-      def continue!(comment = ""); decide!(:continue, comment); end
-      def deny!(comment = ""); decide!(:deny, comment); end
-      def skip!(comment = ""); decide!(:skip, comment); end
+      def allow!(*args, **kwargs); decide!(:allow, *args, **kwargs); end
+      def continue!(*args, **kwargs); decide!(:continue, *args, **kwargs); end
+      def deny!(*args, **kwargs); decide!(:deny, *args, **kwargs); end
+      def skip!(*args, **kwargs); decide!(:skip, *args, **kwargs); end
     end
   end
 end

data/lib/himari/id_token.rb

@@ -11,11 +11,12 @@ module Himari
         claims: authz.claims,
         client_id: authz.client_id,
         nonce: authz.nonce,
+        lifetime: authz.lifetime,
         **kwargs
       )
     end
 
-    def initialize(claims:, client_id:, nonce:, signing_key:, issuer:, access_token: nil, time: Time.now)
+    def initialize(claims:, client_id:, nonce:, signing_key:, issuer:, access_token: nil, time: Time.now, lifetime: 3600)
       @claims = claims
       @client_id = client_id
       @nonce = nonce
@@ -23,6 +24,7 @@ module Himari
       @issuer = issuer
       @access_token = access_token
       @time = time
+      @lifetime = lifetime
     end
 
     attr_reader :claims, :nonce, :signing_key
@@ -34,7 +36,7 @@ module Himari
         aud: @client_id,
         iat: @time.to_i,
         nbf: @time.to_i,
-        exp: (@time + 3600).to_i, # TODO: lifetime
+        exp: (@time + @lifetime).to_i,
       ).merge(
         @nonce ? { nonce: @nonce } : {}
       ).merge(

data/lib/himari/rule_processor.rb

@@ -2,7 +2,7 @@ module Himari
   class RuleProcessor
     class MissingDecisionError < StandardError; end
 
-    Result = Struct.new(:rule_name, :allowed, :explicit_deny, :decision, :decision_log, keyword_init: true) do
+    Result = Struct.new(:rule_name, :allowed, :explicit_deny, :decision, :decision_log, :user_facing_message, :suggestion, keyword_init: true) do
       def as_log
         {
           rule_name: rule_name,
@@ -10,7 +10,9 @@ module Himari
           explicit_deny: explicit_deny,
           decision: decision&.as_log,
           decision_log: decision_log.map(&:to_h),
-        }
+        }.tap do |x|
+          x[:suggestion] = suggestion if suggestion
+        end
       end
     end
 
@@ -47,6 +49,7 @@ module Himari
         result.decision = decision
         result.allowed = true
         result.explicit_deny = false
+        result.user_facing_message = decision.effect_user_facing_message
 
       when :continue
         @decision = decision
@@ -61,6 +64,8 @@ module Himari
         result.decision = nil
         result.allowed = false
         result.explicit_deny = true
+        result.user_facing_message = decision.effect_user_facing_message
+        result.suggestion = decision.effect_suggestion
 
       else
         raise "Unknown effect #{decision.effect} [BUG]"

data/lib/himari/services/downstream_authorization.rb

@@ -21,7 +21,7 @@ module Himari
         end
       end
 
-      Result = Struct.new(:client, :claims, :authz_result) do
+      Result = Struct.new(:client, :claims, :lifetime, :authz_result) do
         def as_log
           {
             client: client.as_log,
@@ -63,10 +63,11 @@ module Himari
         context = Himari::Decisions::Authorization::Context.new(claims: @session.claims, user_data: @session.user_data, request: @request, client: @client).freeze
 
         authorization = Himari::RuleProcessor.new(context, Himari::Decisions::Authorization.new(claims: @session.claims.dup)).run(@authz_rules)
-        raise ForbiddenError.new(Result.new(@client, nil, authorization)) unless authorization.allowed
+        raise ForbiddenError.new(Result.new(@client, nil, nil, authorization)) unless authorization.allowed
 
-        claims = authorization.decision.output
-        Result.new(@client, claims, authorization)
+        claims = authorization.decision.output_claims
+        lifetime = authorization.decision.lifetime
+        Result.new(@client, claims, lifetime, authorization)
       end
     end
   end

data/lib/himari/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Himari
-  VERSION = "0.2.0"
+  VERSION = "0.3.0"
 end

data/public/public/index.css

@@ -58,6 +58,15 @@ main > header img, main > footer img {
   margin-top: 30px;
 }
 
+.notice {
+  background-color: white;
+  border: 1px #bfa88a solid;
+  border-radius: 4px;
+  padding: 4px;
+  margin: 12px;
+  margin-bottom: 24px;
+}
+
 .d-none {
   display: none;
 }

data/views/login.erb

@@ -16,6 +16,12 @@
       <header>
         <h1><%= msg(:title, "Login to Himari") %></h1>
         <%= msg(:header) %>
+
+        <% if @notice %>
+          <div class='notice'>
+            <p><%=h @notice %></p>
+          </div>
+        <% end %>
       </header>
 
       <nav class='actions'>

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: himari
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Sorah Fukumori