katalyst-koi 5.8.3 → 5.9.0

data/app/controllers/admin/background_jobs_controller.rb

@@ -47,11 +47,23 @@ module Admin
 
     def render_state(state)
       states      = BackgroundJob.states
-      @collection = Collection.with_params(params).apply(states.fetch(state).strict_loading)
+      collection  = Collection.new(sorting: default_sort(state))
+      @collection = collection.with_params(params).apply(states.fetch(state).strict_loading)
 
       render locals: { collection:, state_counts: states.transform_values(&:count) }
     end
 
+    def default_sort(state)
+      case state
+      when :completed
+        "finished_at desc"
+      when :failed
+        "updated_at desc"
+      else
+        "scheduled_at desc"
+      end
+    end
+
     def set_background_job
       job             = SolidQueue::Job.find_by!(active_job_id: params.expect(:active_job_id))
       @background_job = BackgroundJob.new(job)
@@ -62,7 +74,6 @@ module Admin
 
       attribute :class_name, :string
       attribute :queue_name, :string
-      attribute :scheduled_at, :date
     end
   end
 end

data/app/controllers/admin/device_authorizations_controller.rb

@@ -19,7 +19,7 @@ module Admin
     end
 
     def create
-      device_authorization, device_code = Admin::DeviceAuthorization.issue!(
+      device_authorization, device_code = Admin::DeviceAuthorization.create_request!(
         requested_ip: request.remote_ip,
         user_agent:   request.user_agent,
       )

data/app/controllers/admin/recurring_tasks_controller.rb

@@ -7,7 +7,7 @@ module Admin
     attr_reader :recurring_task
 
     def index
-      collection = Collection.with_params(params).apply(SolidQueue::RecurringTask.all)
+      collection = Collection.with_params(params).apply(RecurringTask.scope)
 
       render locals: { collection: }
     end
@@ -43,7 +43,6 @@ module Admin
 
       attribute :key, :string
       attribute :schedule, :string
-      attribute :last_enqueued_time, :date
     end
 
     class JobsCollection < Admin::Collection

data/app/controllers/admin/sessions/tokens_controller.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module Admin
+  module Sessions
+    class TokensController < ApplicationController
+      include Koi::Controller::RecordsAuthentication
+
+      before_action :set_admin_user, only: %i[create]
+
+      attr_reader :admin_user
+
+      def show
+        if (@admin_user = Admin::User.find_by_token_for(:password_reset, params[:token]))
+          render locals: { admin_user:, token: params[:token] }
+        else
+          redirect_to(new_admin_session_path, status: :see_other, notice: I18n.t("koi.auth.token_invalid"))
+        end
+      end
+
+      def create
+        render locals: { token: admin_user.generate_token_for(:password_reset) }
+      end
+
+      def update
+        if (@admin_user = Admin::User.find_by_token_for(:password_reset, params[:token]))
+          create_admin_session!(admin_user)
+
+          if admin_user.credentials.any?
+            redirect_to(admin_root_path, status: :see_other)
+          else
+            redirect_to(new_admin_profile_credential_path, status: :see_other)
+          end
+        else
+          redirect_to(new_admin_session_path, status: :see_other, notice: I18n.t("koi.auth.token_invalid"))
+        end
+      end
+
+      private
+
+      def set_admin_user
+        @admin_user = Admin::User.find(params.expect(:admin_user_id))
+      end
+    end
+  end
+end

data/app/controllers/admin/tokens_controller.rb

@@ -2,42 +2,41 @@
 
 module Admin
   class TokensController < ApplicationController
-    include Koi::Controller::RecordsAuthentication
+    DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device-code"
+    JWT_BEARER_GRANT_TYPE  = "urn:ietf:params:oauth:grant-type:jwt-bearer"
 
-    before_action :set_admin_user, only: %i[create]
+    rate_limit to: 20, within: 1.minute, only: :create
+    skip_before_action :verify_authenticity_token, only: :create
 
-    attr_reader :admin_user
-
-    def show
-      if (@admin_user = Admin::User.find_by_token_for(:password_reset, params[:token]))
-        render locals: { admin_user:, token: params[:token] }
+    def create
+      case params[:grant_type]
+      when DEVICE_CODE_GRANT_TYPE
+        authorize_device_code
+      when JWT_BEARER_GRANT_TYPE
+        authorize_bearer_token
       else
-        redirect_to(new_admin_session_path, status: :see_other, notice: I18n.t("koi.auth.token_invalid"))
+        render(json: { error: "invalid_request" }, status: :bad_request)
       end
     end
 
-    def create
-      render locals: { token: admin_user.generate_token_for(:password_reset) }
-    end
-
-    def update
-      if (@admin_user = Admin::User.find_by_token_for(:password_reset, params[:token]))
-        create_admin_session!(admin_user)
+    private
 
-        if admin_user.credentials.any?
-          redirect_to(admin_root_path, status: :see_other)
-        else
-          redirect_to(new_admin_profile_credential_path, status: :see_other)
-        end
-      else
-        redirect_to(new_admin_session_path, status: :see_other, notice: I18n.t("koi.auth.token_invalid"))
-      end
+    def authorize_device_code
+      render json: Admin::DeviceAuthorization.consume_request!(device_code: params[:device_code])
+    rescue Admin::DeviceAuthorization::TokenError => e
+      render json: { error: e.code }, status: :bad_request
     end
 
-    private
+    def authorize_bearer_token
+      assertion = Koi::Identity.authorize_bearer_token!(params[:assertion], audience: "#{request.base_url}/admin")
 
-    def set_admin_user
-      @admin_user = Admin::User.find(params.expect(:admin_user_id))
+      render json: Admin::DeviceAuthorization.issue_token!(
+        principal:    assertion.principal,
+        requested_ip: request.remote_ip,
+        user_agent:   request.user_agent,
+      )
+    rescue JWT::DecodeError
+      render json: { error: "invalid_grant" }, status: :bad_request
     end
   end
 end

data/app/controllers/concerns/koi/controller.rb

@@ -39,6 +39,8 @@ module Koi
 
       protect_from_forgery with: :exception
       skip_forgery_protection if: :bearer_token_request?
+
+      after_action :set_release_headers
     end
 
     private
@@ -46,5 +48,25 @@ module Koi
     def bearer_token_request?
       request.authorization.to_s.match?(/\ABearer .+\z/)
     end
+
+    # HTML responses carry the release in meta tags (see Koi::Release.meta_tags);
+    # JSON consumers get the same information as response headers.
+    def set_release_headers
+      return unless response.media_type == "application/json"
+
+      response.set_header("X-Application-Version", Koi::Release.version)
+      response.set_header("X-Application-Revision", Koi::Release.revision)
+    end
+
+    # Surface the grant's stored principal on the request's process_action
+    # payload so structured loggers attribute machine requests to the
+    # verified identity that minted the token.
+    def append_info_to_payload(payload)
+      super
+
+      if (principal = Koi::Current.principal)
+        payload[:principal] = { provider: principal.provider, subject: principal.subject }
+      end
+    end
   end
 end

data/app/models/admin/device_authorization.rb

@@ -2,7 +2,8 @@
 
 module Admin
   class DeviceAuthorization < ApplicationRecord
-    EXPIRES_IN = 10.minutes
+    REQUEST_EXPIRES_IN = 10.minutes
+    TOKEN_EXPIRES_IN   = 1.hour
 
     class TokenError < StandardError
       attr_reader :code
@@ -17,12 +18,17 @@ module Admin
 
     enum :status, %w[pending approved denied consumed].index_with(&:to_s)
 
-    generates_token_for(:api_access, expires_in: 12.hours) { admin_user&.last_sign_in_at }
+    generates_token_for(:api_access, expires_in: TOKEN_EXPIRES_IN) do
+      admin_user&.last_sign_in_at || admin_role&.tokens_revoked_at
+    end
 
-    validates :device_code_digest, presence: true, uniqueness: true
-    validates :request_expires_at, presence: true
     validates :status, presence: true, inclusion: { in: statuses.values }
-    validates :user_code, presence: true, uniqueness: true
+
+    with_options(if: :pending?) do
+      validates :device_code_digest, presence: true, uniqueness: true
+      validates :user_code, presence: true, uniqueness: true
+      validates :request_expires_at, presence: true
+    end
 
     belongs_to :admin_user,
                class_name:    "Admin::User",
@@ -30,13 +36,23 @@ module Admin
                inverse_of:    :device_authorizations,
                optional:      true
 
-    def self.issue!(requested_ip:, user_agent:)
+    belongs_to :admin_role,
+               class_name: "Admin::Role",
+               inverse_of: :device_authorizations,
+               optional:   true
+
+    # Snapshot of the verified principal, as captured by `issue_token!`.
+    serialize :principal, coder: Koi::Identity::Principal
+    attr_readonly :principal
+
+    # Creates a new un-approved request.
+    def self.create_request!(requested_ip:, user_agent:)
       device_code = SecureRandom.urlsafe_base64(32)
 
       device_authorization = create!(
         device_code_digest: digest(device_code),
         user_code:          generate_user_code,
-        request_expires_at: EXPIRES_IN.from_now,
+        request_expires_at: REQUEST_EXPIRES_IN.from_now,
         requested_ip:,
         user_agent:,
       )
@@ -52,7 +68,8 @@ module Admin
       "#{SecureRandom.alphanumeric(4).upcase}-#{SecureRandom.alphanumeric(4).upcase}"
     end
 
-    def self.issue_access_token!(device_code:, token_expires_in: 12.hours)
+    # Consume an approved request, returns the issued token payload.
+    def self.consume_request!(device_code:)
       device_authorization = find_by(device_code_digest: digest(device_code.to_s))
       raise TokenError.new("invalid_grant") unless device_authorization
 
@@ -63,19 +80,38 @@ module Admin
           raise TokenError.new(error)
         end
 
-        access_token = device_authorization.generate_token_for(:api_access)
-        device_authorization.consume!(token_expires_in:)
+        device_authorization.consume!
+      end
+    end
 
-        {
-          access_token:,
-          token_type:   "Bearer",
-          expires_in:   token_expires_in.to_i,
-        }
+    # Issue a new token directly from a validated assertion, returns the issued token payload.
+    def self.issue_token!(principal:, **)
+      case principal.scope
+      when "admin/user"
+        admin_user = Admin::User.find_by(principal.attributes_for_find)
+
+        unless admin_user
+          Rails.logger.warn("Koi::Identity rejected #{principal}: no matching admin user")
+          raise JWT::VerificationError, "unknown user for #{principal}"
+        end
+
+        new(admin_user:, principal:, **).consume!
+      when %r{\Aadmin/role/(?<slug>[a-z0-9_]+)\z}
+        admin_role = Admin::Role.materialize(Regexp.last_match(:slug))
+
+        new(admin_role:, principal:, **).consume!
+      else
+        raise ArgumentError, "unknown scope #{principal.scope.inspect}"
       end
     end
 
+    # @return [Admin::User, Admin::Role, nil]
+    def actor
+      admin_user || admin_role
+    end
+
     def expired?
-      request_expires_at <= Time.current
+      request_expires_at.present? && request_expires_at <= Time.current
     end
 
     def issuable?
@@ -89,12 +125,14 @@ module Admin
       "invalid_grant" if consumed? || expired?
     end
 
-    def consume!(token_expires_in:)
+    def consume!
       update!(
         status:           "consumed",
         consumed_at:      Time.current,
-        token_expires_at: token_expires_in.from_now,
+        token_expires_at: TOKEN_EXPIRES_IN.from_now,
       )
+
+      token_payload
     end
 
     def approve!(admin_user:)
@@ -115,5 +153,15 @@ module Admin
     def actionable?
       pending? && !expired?
     end
+
+    private
+
+    def token_payload(access_token = generate_token_for(:api_access))
+      {
+        access_token:,
+        token_type:   "Bearer",
+        expires_in:   (token_expires_at - Time.current).round,
+      }
+    end
   end
 end

data/app/models/admin/role.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module Admin
+  # A machine actor, assumable only via an identity member's grant — nothing
+  # signs in as a role. Config declares roles (a role exists when a member's
+  # scope names it); the row is the stable identity that grants and audit
+  # records reference, materialized on first use and never deleted.
+  class Role < ApplicationRecord
+    self.table_name = :admin_roles
+
+    validates :slug, presence: true
+
+    has_many :device_authorizations,
+             class_name:  "Admin::DeviceAuthorization",
+             foreign_key: :admin_role_id,
+             inverse_of:  :admin_role,
+             dependent:   :destroy
+
+    def self.materialize(slug)
+      create_or_find_by!(slug:)
+    end
+
+    # Config is authoritative for grants: a row whose slug no longer appears
+    # in any member's scope is not assumable, but remains for attribution.
+    def orphaned?
+      Koi::Identity.role_slugs.exclude?(slug)
+    end
+
+    # Members granting this role in the current trust config.
+    def members
+      Koi::Identity.members.select { |member| member.role_slug == slug }
+    end
+
+    # Roles authenticate by exchanging an assertion for a token; requests
+    # made with the token never touch this row, so issuance is the freshest
+    # signal available.
+    def last_authenticated_at
+      device_authorizations.maximum(:consumed_at)
+    end
+  end
+end

data/app/models/background_job.rb

@@ -3,6 +3,15 @@
 class BackgroundJob
   include ActiveModel::Model
 
+  module Scopes
+    def admin_search(query)
+      where(
+        "solid_queue_jobs.class_name LIKE :query OR solid_queue_jobs.queue_name LIKE :query",
+        query: "%#{query}%",
+      )
+    end
+  end
+
   # @return [SolidQueue::Job]
   attr_reader :job
 
@@ -18,7 +27,7 @@ class BackgroundJob
       blocked:     SolidQueue::Job.where.associated(:blocked_execution),
       failed:      SolidQueue::Job.failed,
       completed:   SolidQueue::Job.finished,
-    }
+    }.transform_values { |jobs| jobs.extending(Scopes) }
   end
 
   # @param [SolidQueue::Job] job

data/app/models/koi/current.rb

@@ -8,6 +8,16 @@ module Koi
     # @return [Admin::Session, nil]
     attribute :session
 
+    # @return [Admin::User, Admin::Role, nil]
+    def actor
+      device_authorization&.actor || session&.admin
+    end
+
+    # @return [Koi::Identity::Principal, nil]
+    def principal
+      device_authorization&.principal
+    end
+
     # @return [Admin::User, nil]
     def admin_user
       device_authorization&.admin_user || session&.admin

data/app/models/koi/identity/assertion.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+module Koi
+  module Identity
+    class Assertion
+      # @return String
+      attr_reader :token
+
+      # @return Principal
+      attr_reader :principal
+
+      def initialize(token)
+        @token           = token
+        @claims, @header = JWT.decode(token, nil, false)
+        @state           = :unverified
+      end
+
+      def verified?
+        @state == :verified
+      end
+
+      def claims
+        @claims
+      end
+
+      def header
+        @header
+      end
+
+      def verify!(provider)
+        # The library validates required_claims after verify_jti, but
+        # consume_jti derives its cache TTL from exp — so require it first.
+        raise JWT::MissingRequiredClaim, "missing required claim exp" if claims["exp"].nil?
+
+        JWT.decode(
+          @token, nil, true,
+          algorithms:      provider.algorithms,
+          jwks:            provider.method(:key_set),
+          aud:             provider.audience,
+          leeway:          provider.leeway.to_i,
+          required_claims: %w[exp],
+          verify_aud:      true,
+          verify_jti:      provider.method(:consume_jti)
+        )
+
+        if claims["exp"].to_i > provider.max_expiry.from_now.to_i
+          raise JWT::InvalidPayload, "assertion expiry is more than #{provider.max_expiry.inspect} away"
+        end
+
+        # ensure that we can map the claim to a valid principal using the claim's subject
+        @principal = Identity.principal_for(provider, self)
+
+        if principal.blank? || principal.subject.blank?
+          raise(JWT::InvalidSubError, "unknown subject #{subject} for provider #{provider.name}")
+        end
+
+        @state = :verified
+
+        self
+      end
+
+      def iss
+        @claims["iss"]
+      end
+      alias_method :issuer, :iss
+
+      def sub
+        @claims["sub"]
+      end
+      alias_method :subject, :sub
+
+      def inspect
+        "<#{self.class.name} iss=#{iss.inspect} sub=#{sub.inspect}>"
+      end
+      alias :to_s :inspect
+    end
+  end
+end

data/app/models/koi/identity/member.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module Koi
+  module Identity
+    # A named trust rule from config: pairs a provider and an exact subject
+    # with the scope a verified assertion may act as.
+    class Member
+      include ActiveModel::Model
+      include ActiveModel::Attributes
+
+      SCOPES = %r{\Aadmin/user\z|\Aadmin/role/(?<slug>[a-z0-9_]+)\z}
+
+      attribute :name, :string
+      attribute :provider, :string
+      attribute :scope, :string
+      attribute :subject, :string
+
+      # Provider names declared in config, for cross-checking references.
+      attr_accessor :provider_names
+
+      validates :provider, :scope, :subject, presence: true
+      validates :provider, inclusion: { in: ->(member) { member.provider_names || [] }, allow_blank: true }
+      validates :scope, format: { with: SCOPES, allow_blank: true }
+
+      def role_slug
+        scope&.[](SCOPES, :slug)
+      end
+    end
+  end
+end

data/app/models/koi/identity/principal.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Koi
+  module Identity
+    class Principal
+      include ActiveModel::Model
+      include ActiveModel::Attributes
+
+      def self.dump(principal)
+        principal&.attributes&.to_json
+      end
+
+      def self.load(json)
+        return if json.blank?
+
+        Principal.new(**JSON.parse(json).slice(*attribute_names))
+      end
+
+      # Required attributes
+      attribute :provider, :string
+      attribute :subject, :string
+      attribute :scope, :string
+
+      # Optional extensions, required for user authentication
+      attribute :name, :string
+      attribute :email, :string
+
+      def attributes_for_find
+        { email: }
+      end
+
+      def inspect
+        "<#{self.class.name} provider=#{provider.inspect} scope=#{scope.inspect} subject=#{subject.inspect} " \
+          "name=#{name.inspect} email=#{email.inspect}>"
+      end
+
+      alias :to_s :inspect
+    end
+  end
+end