masks-server 0.10.0 → 0.11.0

data/config/locales/fr/events.yml

@@ -157,6 +157,8 @@ fr:
         exported: "Activité exportée"
       mail_template:
         updated: "Modèle d’e-mail modifié"
+      job:
+        failed: "Tâche de fond échouée pour ce locataire"
       stream:
         created: "Flux d’événements ajouté"
         updated: "Flux d’événements modifié"
@@ -171,6 +173,8 @@ fr:
       signal:
         undelivered: "Signal partagé non transmis"
         received: "Déconnexion signalée par un fournisseur"
+      text:
+        undelivered: "SMS non transmis"
       organization:
         created: "Organisation ajoutée"
         updated: "Organisation modifiée"

data/config/locales/fr/handshakes.yml

@@ -26,7 +26,7 @@ fr:
       area_yours: " Vous les recevez toutes dès maintenant."
       also: "%{name} peut aussi"
       details: "Détails techniques"
-      scopes: "Scopes"
+      scopes: "Portées"
       client: "Identifiants"
       credentials:
         public: "Publique. Elle ne détient aucun secret."

data/config/locales/fr/manage/client.yml

@@ -173,7 +173,7 @@ fr:
         on_request: "Sur demande"
       uris:
         title: "URI"
-        acs: "Assertion consumer services"
+        acs: "Services consommateurs d'assertions"
         redirect: "Redirection"
         post_logout: "Redirection post-déconnexion"
         resources: "Ressources"

data/config/locales/fr/manage/clients.yml

@@ -30,7 +30,7 @@ fr:
       metadata: "Ses métadonnées"
       read: "Les lire"
       entity_id: "Entity ID"
-      acs: "Assertion consumer services"
+      acs: "Services consommateurs d'assertions"
       certificate: "Certificat de signature, s’il signe ses requêtes"
       requests_signed: "Refuser les requêtes qu’il n’a pas signées"
       slo_url: "URL de déconnexion unique, s’il en a une"

data/config/locales/fr/manage/machines.yml

@@ -0,0 +1,13 @@
+fr:
+  manage:
+    machines:
+      title: "Machines"
+      lede: "Clients que cette application a inscrits avec un jeton d'inscription. Chacun se connecte avec sa propre clé."
+      empty: "Cette application n'a pas encore inscrit de machine."
+      last_seen: "Dernière connexion %{day}"
+      never: "Jamais connectée"
+      enrolled: "Inscrite %{day}"
+      enrolled_by: "Une machine inscrite par"
+      revoke: "Révoquer"
+      revoke_confirm: "Révoquer %{name} ? Elle est archivée, chaque jeton prend fin et elle ne peut plus se connecter."
+      revoked: "%{name} est révoquée et ne peut plus se connecter."

data/config/locales/fr/manage/providers.yml

@@ -77,7 +77,7 @@ fr:
         credentials: "Identifiants"
         services_id: "Services ID"
         client_id: "Client ID"
-        client_secret: "Client secret"
+        client_secret: "Secret du client"
         unchanged: "inchangé"
         team_id: "Team ID"
         key_id: "Key ID"

data/config/routes.rb

@@ -4,6 +4,7 @@ Masks::Server::Engine.routes.draw do
   get "/.well-known/jwks.json", to: "discovery#jwks"
   get "/.well-known/oauth-protected-resource(/*resource)", to: "discovery#resource"
   get "/.well-known/ssf-configuration", to: "signal_streams#configuration"
+  get "/.well-known/webfinger", to: "discovery#webfinger"
 
   scope "/ssf", controller: :signal_streams, defaults: { format: :json } do
     get "/streams", action: :show

data/db/migrate/20261019140000_add_indexes_for_cleanup_and_metrics.rb

@@ -0,0 +1,10 @@
+class AddIndexesForCleanupAndMetrics < ActiveRecord::Migration[8.1]
+  def change
+    add_index :sessions, %i[tenant_id expires_at]
+    add_index :sessions, %i[tenant_id revoked_at], where: "revoked_at IS NOT NULL"
+    add_index :sessions, %i[tenant_id created_at]
+    add_index :tokens, %i[tenant_id kind created_at]
+    add_index :tokens, "tenant_id, LEAST(consumed_at, expires_at)", name: "index_tokens_on_tenant_id_and_ended_at"
+    add_index :signing_keys, %i[tenant_id retired_at], where: "retired_at IS NOT NULL"
+  end
+end

data/lib/masks/server/configuration.rb

@@ -46,6 +46,10 @@ module Masks
         config.ldap_cert = ENV["MASKS_LDAP_CERT"].presence
         config.ldap_key = ENV["MASKS_LDAP_KEY"].presence
         config.ldap_plaintext = ENV.fetch("MASKS_LDAP_PLAINTEXT", "false") == "true"
+        config.worker_silence = ENV.fetch("MASKS_WORKER_SILENCE", 300).to_i.seconds
+        config.queue_wait = ENV.fetch("MASKS_QUEUE_WAIT", 600).to_i.seconds
+        config.finished_job_retention = ENV.fetch("MASKS_FINISHED_JOB_RETENTION", 7 * 24 * 60 * 60).to_i.seconds
+        config.failed_job_retention = ENV.fetch("MASKS_FAILED_JOB_RETENTION", 30 * 24 * 60 * 60).to_i.seconds
         config
       end
 

data/lib/tasks/masks.rake

@@ -3,20 +3,44 @@ namespace :masks do
   task tenants: :environment do
     Masks::Server::MasterKey.check!
 
-    Masks::Server::Tenant.declare!.each { |tenant| puts "#{tenant.subdomain}: #{tenant.signing_key.kid}" }
+    config = Rails.configuration.masks
+    announce = lambda do |outcome, lines|
+      if outcome.done?
+        lines.call(outcome.value).each { |line| puts "masks: #{line}" }
+        puts "masks: #{outcome.name} done on #{outcome.host}"
+      else
+        puts "masks: #{outcome.name} already done on #{outcome.host}, skipped"
+      end
+    end
+
+    declared = Masks::Server::BootTask.once("tenants", fingerprint: config.tenants.join(",")) { Masks::Server::Tenant.declare! }
+    announce.call(declared, ->(tenants) { tenants.map { |tenant| "#{tenant.subdomain}: #{tenant.signing_key.kid}" } })
 
     Masks::Server::Tenant.active.reject(&:set_up?).each { |tenant| puts "masks: #{tenant.setup_announcement}" }
 
-    Masks::Server::Declared.apply!.each { |said| puts "masks: #{said}" }
+    if config.config_path.present?
+      digest = File.exist?(config.config_path) ? Digest::SHA256.file(config.config_path).hexdigest : config.config_path
+      applied = Masks::Server::BootTask.once("config", fingerprint: digest) { Masks::Server::Declared.apply! }
+      announce.call(applied, ->(said) { said })
+    end
 
-    Masks::Server::LockedOut.recover!.each { |recovered| puts "masks: #{recovered}" }
+    if config.recover.present?
+      recovered = Masks::Server::BootTask.once("recover", fingerprint: config.recover) { Masks::Server::LockedOut.recover! }
+      announce.call(recovered, ->(lines) { lines })
+    end
 
     if ENV["ENCRYPTION_PREVIOUS_PRIMARY_KEY"].present?
-      Masks::Server::MasterKey.reencrypt!
-      puts "masks: every encrypted column now uses the current master key. Remove MASKS_PREVIOUS_MASTER_KEY."
+      reencrypted = Masks::Server::BootTask.once("reencrypt", fingerprint: ENV["ENCRYPTION_PREVIOUS_PRIMARY_KEY"]) do
+        Masks::Server::MasterKey.reencrypt!
+        [ "every encrypted column now uses the current master key. Remove MASKS_PREVIOUS_MASTER_KEY." ]
+      end
+      announce.call(reencrypted, ->(lines) { lines })
     elsif Masks::Server::MasterKey.underived.exists?
-      Masks::Server::MasterKey.reencrypt!(Masks::Server::MasterKey.underived)
-      puts "masks: every tenant's encrypted columns now use a key of that tenant's own."
+      derived = Masks::Server::BootTask.once("derive", fingerprint: Masks::Server::MasterKey.underived.pluck(:id).sort.join(",")) do
+        Masks::Server::MasterKey.reencrypt!(Masks::Server::MasterKey.underived)
+        [ "every tenant's encrypted columns now use a key of that tenant's own." ]
+      end
+      announce.call(derived, ->(lines) { lines })
     end
   end
 end

data/public/masks-assets/.vite/manifest.json

@@ -51,7 +51,7 @@
     ]
   },
   "entrypoints/manage.js": {
-    "file": "assets/manage-DR9qQiBU.js",
+    "file": "assets/manage-D4MzaDvM.js",
     "name": "entrypoints/manage.js",
     "src": "entrypoints/manage.js",
     "isEntry": true,