masks-server 0.10.0 → 0.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 544dc01d0600507eb713667f0d8cf57275b4b7d957b603e3085f9e197e7e63c6
-  data.tar.gz: 70f664c959b40e98e9a273582a45c0dba352e5186430a72c26e3a8dd87db978b
+  metadata.gz: 74cc1568b822c061657b6625a809deb750f5503e66fa8d0f390c7a596004953e
+  data.tar.gz: 8bdb0e298ee2c901c71f654215fd0b958d36cd6e69befa231313dd2f98a5d249
 SHA512:
-  metadata.gz: a5c6177ca713658c3003f33cea0b8902c6810266271f4d4e6d0215d8a291b6da13a47add90dca3b65df3f9614f6161dd5627853c3e9038ddafffcc0963ce27d4
-  data.tar.gz: 872c0d7ce2bd4090f885fdbce3eb82d8459ff73840ac89d3bd9cd2088ae334dc1efb2c34fe7bc17a2f413492d07c15c74a69f73b771f98847a4a69ae10416228
+  metadata.gz: e0aa16a41f23221d2274bf66aac45ba8a1c20c901526cfd79905d14a229b3614921dba96c90a4ad296f69a210c8aee6d6aa11453d063d8a07cd9b1b724f13feb
+  data.tar.gz: 4c36c8378c7d459c4c4280227d36ec6f91234d3c2db47f857b8165312af340958789373497de7aa244f8c13ceb09a33415e2de40af99eed39331d1c3161b0838

data/app/controllers/masks/server/account_controller.rb

@@ -9,6 +9,9 @@ module Masks
         return redirect_to login_path if @actor.nil?
 
         @apps = Apps.held_by(@actor)
+        @app_passwords = AppPassword.live.where(actor: @actor).includes(:client).newest_first.to_a
+        @app_password_clients = AppPassword.offered(@actor)
+        @app_password = flash[:app_password]
         @launchable = Apps.launchable(@actor)
         @invitations = @actor.memberships.outstanding.joins(:organization).merge(Organization.active)
                              .includes(:organization, :invited_by).order("organizations.name").to_a

data/app/controllers/masks/server/app_passwords_controller.rb

@@ -0,0 +1,41 @@
+module Masks
+  module Server
+    class AppPasswordsController < ApplicationController
+      ANCHOR = "app-passwords".freeze
+
+      before_action :require_actor
+
+      def create
+        return unless reauthenticated!(ANCHOR, t("app_passwords.again"))
+
+        client = Client.active.find_by(client_id: params[:client_id].to_s)
+        held = AppPassword.issue!(actor: current_actor, client: client, name: params[:name])
+
+        Event.record!(Event::APP_PASSWORD_CREATED, actor: current_actor, client: client, name: held.name)
+
+        flash[:app_password] = { "name" => held.name, "app" => client.name, "secret" => held.secret }
+        redirect_to root_path(anchor: ANCHOR)
+      rescue AppPassword::Refused => e
+        redirect_to root_path(anchor: ANCHOR), alert: t("app_passwords.refused.#{e.message}", most: AppPassword::MOST)
+      end
+
+      def destroy
+        held = AppPassword.live.find_by(id: params[:id].to_s[/\A\d+\z/], actor: current_actor)
+
+        return redirect_to root_path(anchor: ANCHOR), alert: t("app_passwords.unknown") if held.nil?
+
+        held.revoke!
+
+        Event.record!(Event::APP_PASSWORD_REVOKED, actor: current_actor, client: held.client, name: held.name)
+
+        redirect_to root_path(anchor: ANCHOR), notice: t("app_passwords.revoked", name: held.name)
+      end
+
+      private
+
+        def require_actor
+          redirect_to login_path unless current_actor
+        end
+    end
+  end
+end

data/app/controllers/masks/server/authorize_controller.rb

@@ -9,6 +9,10 @@ module Masks
         refuse(bad_request(:invalid_request_object, refusal.message))
       end
 
+      rate_limit to: 1, within: 1.hour, only: :ask,
+                 by: -> { [ current_tenant.id, current_actor&.id, refused_request(params[:rid])&.client_id ].join(":") },
+                 with: -> { redirect_to authorize_refused_path(rid: params[:rid]), alert: t("authorize.error.slow_down") }
+
       def show
         authorization = Authorization.from_request(request)
 
@@ -45,7 +49,7 @@ module Masks
 
         login = advance(pending)
 
-        return redirect_to(refuse_on_masks(pending, login.refusal)) if login.refused? && !answerable?(pending)
+        return redirect_to(refuse_on_masks(pending, login.refusal)) if login.refused? && (!answerable?(pending) || askable?(pending, login))
         return answer(deny(pending, login.refusal.error, login.refusal.description)) if login.refused?
         return interaction_required(pending) if login.prompted? && pending.silent?
         return redirect_to(login.redirect_to, allow_other_host: true) if login.redirect_to.present?
@@ -55,14 +59,31 @@ module Masks
       end
 
       def refused
-        refusal = refused_request(params[:rid])&.refusal
+        pending = refused_request(params[:rid])
+        refusal = pending&.refusal
 
         return show_error("invalid_request", "that sign-in request has expired", :bad_request) if refusal.nil?
 
         @refused = true
+        @asking = asking_for(pending)
+        @waiting = @asking && AccessRequest.open.find_by(actor: current_actor, client: @asking)
+        @return_to = answerable?(pending) && pending.authorization.redirect_with(
+          issuer: issuer, error: refusal["error"], error_description: refusal["description"]
+        )
         show_error(refusal["error"], refusal["description"], :forbidden)
       end
 
+      def ask
+        pending = refused_request(params[:rid])
+        asking = pending && asking_for(pending)
+
+        return show_error("invalid_request", "that sign-in request has expired", :bad_request) if asking.nil?
+
+        AccessRequest.ask!(actor: current_actor, client: asking)
+
+        redirect_to authorize_refused_path(rid: params[:rid]), notice: t("authorize.error.asked")
+      end
+
       private
 
         def validate(authorization)
@@ -149,6 +170,16 @@ module Masks
           end
         end
 
+        def askable?(pending, login)
+          !pending.silent? && login.actor.present? && asking_for(pending, login.actor).present?
+        end
+
+        def asking_for(pending, actor = current_actor)
+          client = pending.client
+
+          client if actor && client && client.allowed_groups.any? && !client.admits?(actor)
+        end
+
         def admitted?(authorization)
           tracked(REQUESTS).key?(authorization.fingerprint)
         end

data/app/controllers/masks/server/discovery_controller.rb

@@ -1,6 +1,9 @@
 module Masks
   module Server
     class DiscoveryController < ApplicationController
+      OPENID_ISSUER = "http://openid.net/specs/connect/1.0/issuer".freeze
+      LONGEST_RESOURCE = 512
+
       def openid
         render json: issuer.discovery
       end
@@ -13,6 +16,39 @@ module Masks
       def resource
         render json: issuer.protected_resource
       end
+
+      def webfinger
+        resource = params[:resource].to_s
+        host = resource_host(resource)
+
+        return head(:bad_request) if host.nil?
+        return head(:not_found) unless host.casecmp?(URI.parse(issuer.url).host)
+
+        asked = Array(params[:rel]).map(&:to_s)
+        links = [ { "rel" => OPENID_ISSUER, "href" => issuer.url } ]
+        links = links.select { |link| asked.include?(link["rel"]) } if asked.any?
+
+        response.headers["Access-Control-Allow-Origin"] = "*"
+        render json: { "subject" => resource, "links" => links }, content_type: "application/jrd+json"
+      end
+
+      private
+
+        def resource_host(resource)
+          return nil if resource.blank? || resource.length > LONGEST_RESOURCE
+
+          if resource.start_with?("acct:")
+            account, separator, host = resource.delete_prefix("acct:").rpartition("@")
+
+            return nil if separator.empty? || account.blank? || host.blank? || host.match?(%r{[/\\\s?#]})
+
+            host.sub(/:\d+\z/, "")
+          elsif resource.match?(%r{\Ahttps?://})
+            URI.parse(resource).host
+          end
+        rescue URI::InvalidURIError
+          nil
+        end
     end
   end
 end

data/app/controllers/masks/server/enrollments_controller.rb

@@ -12,6 +12,15 @@ module Masks
                    }, status: :too_many_requests
                  }
 
+      rate_limit to: 60, within: 1.hour, only: :create, name: "app",
+                 by: -> { [ current_tenant.id, claimed_client_id ].join(":") },
+                 with: -> {
+                   render json: {
+                     "error" => "too_many_requests",
+                     "error_description" => "too many enrollment tokens asked for by this app"
+                   }, status: :too_many_requests
+                 }
+
       before_action :no_store!
 
       def create
@@ -55,6 +64,14 @@ module Masks
           client
         end
 
+        def claimed_client_id
+          basic = ActionController::HttpAuthentication::Basic
+
+          named, = basic.user_name_and_password(request) if basic.has_basic_credentials?(request)
+
+          (named.presence || params[:client_id]).to_s
+        end
+
         def not_enrolled
           render json: {
             "error" => "invalid_request",

data/app/controllers/masks/server/forward_auth_controller.rb

@@ -15,13 +15,21 @@ module Masks
 
         client = Client.forwarding_to(target)
         return head(:forbidden) if client.nil?
+        return basic(client, target) if ActionController::HttpAuthentication::Basic.has_basic_credentials?(request)
 
         held = ForwardSession.held(cookies[ForwardSession::COOKIE], client)
-        return admit(held.actor) if held
-
-        return head(:unauthorized) if params[:status] == "401"
-
-        redirect_to forward_auth_start_url(rd: target.to_s), allow_other_host: true
+        decided = client.forward_rules.decide(path: target.path, method: forwarded_method, address: request.remote_ip,
+                                              actor: held&.actor)
+
+        case decided.outcome
+        when ForwardAuthRules::OPEN then admit(held&.actor)
+        when ForwardAuthRules::DENY then head(:forbidden)
+        when ForwardAuthRules::ONE_FACTOR then held ? admit(held.actor) : ask_to_sign_in(target)
+        when ForwardAuthRules::TWO_FACTOR then held&.session&.multi_factored? ? admit(held.actor) : ask_to_sign_in(target)
+        else
+          complete = held if held&.session&.complete?
+          decided.outcome == ForwardAuthRules::TOKEN ? admit_presented(client, complete) : answer(complete, target)
+        end
       end
 
       def start
@@ -29,8 +37,20 @@ module Masks
         client = Client.forwarding_to(target)
 
         return render(plain: t("forward_auth.unknown"), status: :not_found) if client.nil?
-        return redirect_to(login_path(return_to: request.fullpath)) if current_actor.nil?
-        return render(plain: t("forward_auth.not_admitted", app: client.name), status: :forbidden) unless client.admits?(current_actor)
+
+        decided = client.forward_rules.decide(path: target.path, method: "GET", address: request.remote_ip, actor: current_actor)
+
+        return render(plain: t("forward_auth.denied", app: client.name), status: :forbidden) if decided.outcome == ForwardAuthRules::DENY
+        return send_to_login(decided) if current_actor.nil?
+
+        unless client.admits?(current_actor)
+          return redirect_to(target.to_s, allow_other_host: true) if decided.outcome == ForwardAuthRules::OPEN
+
+          return render(plain: t("forward_auth.not_admitted", app: client.name), status: :forbidden)
+        end
+
+        return step_up if decided.outcome == ForwardAuthRules::TWO_FACTOR && !current_session.multi_factored?
+        return step_up if [ ForwardAuthRules::ONE_FACTOR, ForwardAuthRules::OPEN ].exclude?(decided.outcome) && !current_session.complete?
 
         code = ForwardCode.mint!(actor: current_actor, client: client, session: current_session,
                                  payload: { "return_to" => target.to_s })
@@ -67,15 +87,87 @@ module Masks
           redirect_to code.return_to, allow_other_host: true
         end
 
-        def admit(actor)
-          response.headers["Remote-User"] = actor.nickname.presence || actor.identifier
-          response.headers["Remote-Email"] = actor.email if actor.email_verified_at.present?
-          response.headers["Remote-Name"] = actor.name if actor.name.present?
-          response.headers["Remote-Groups"] = actor.group_labels.join(",")
+        def basic(client, target)
+          identifier, secret = ActionController::HttpAuthentication::Basic.user_name_and_password(request)
+          outcome = AppPasswords.authenticate(client: client, identifier: identifier, secret: secret, via: "forward_auth")
+
+          return head(:too_many_requests) if outcome.throttled?
+          return head(:unauthorized) if outcome.actor.nil?
+
+          decided = client.forward_rules.decide(path: target.path, method: forwarded_method, address: request.remote_ip,
+                                                actor: outcome.actor)
+          return head(:forbidden) if decided.outcome == ForwardAuthRules::DENY
+
+          admit(outcome.actor)
+        end
+
+        def answer(held, target)
+          held ? admit(held.actor) : ask_to_sign_in(target)
+        end
+
+        def ask_to_sign_in(target)
+          return head(:unauthorized) if params[:status] == "401"
+
+          redirect_to forward_auth_start_url(rd: target.to_s), allow_other_host: true
+        end
+
+        def send_to_login(decided)
+          Login.new(store: login_store).relax! if decided.outcome == ForwardAuthRules::ONE_FACTOR
+
+          redirect_to login_path(return_to: request.fullpath)
+        end
+
+        def step_up
+          Login.new(store: login_store).step_up!
+
+          redirect_to login_path(return_to: request.fullpath)
+        end
+
+        def admit_presented(client, held)
+          return admit(held.actor) if held
+
+          token = presented_token(client)
+          return admit(token.actor, machine: token.client) if token
+
+          response.headers["WWW-Authenticate"] = %(Bearer realm="#{client.forward_origin}")
+          head :unauthorized
+        end
+
+        def presented_token(client)
+          scheme, secret = request.authorization.to_s.split(" ", 2)
+          return nil unless scheme.to_s.casecmp?("Bearer") && secret.present?
+
+          claims = AccessToken.decode(secret.strip, issuer: issuer)
+          token = AccessToken.live.includes(:actor, :client).find_by(digest: claims["jti"])
+
+          return nil if token.nil? || token.bound? || token.client.nil?
+          return nil unless token.client_id == client.id || Array(token.audience).include?(client.forward_origin)
+          return nil if token.actor && (token.actor.suspended? || !client.admits?(token.actor))
+
+          token
+        rescue JWT::DecodeError
+          nil
+        end
+
+        def admit(actor, machine: nil)
+          if actor
+            response.headers["Remote-User"] = actor.nickname.presence || actor.identifier
+            response.headers["Remote-Email"] = actor.email if actor.email_verified_at.present?
+            response.headers["Remote-Name"] = actor.name if actor.name.present?
+            response.headers["Remote-Groups"] = actor.group_labels.join(",")
+          elsif machine
+            response.headers["Remote-User"] = machine.client_id
+            response.headers["Remote-Name"] = machine.name
+            response.headers["Remote-Groups"] = ""
+          end
 
           head :ok
         end
 
+        def forwarded_method
+          request.headers["X-Forwarded-Method"].presence || request.headers["X-Original-Method"].presence || "GET"
+        end
+
         def return_to
           raw = request.query_string[/(?:\A|&)rd=(.*)\z/m, 1].to_s
 

data/app/controllers/masks/server/logins_controller.rb

@@ -35,9 +35,9 @@ module Masks
 
       def show
         hold_return_to
-        return redirect_to after_login_path if current_actor && pending.nil?
-
         @login = run
+        return redirect_to after_login_path if current_actor && pending.nil? && !@login.stepping_up?
+
         @login.carry!(flash[:warnings]) if flash[:warnings].present?
 
         redirect_to after_login_path if @login.settled?
@@ -153,8 +153,9 @@ module Masks
           if login.touched?(:first_factor)
             sign_in(login.actor, amr: login.amr, policy: login.policy, first_factor: login.first_factored_by,
                                  authenticated_at: login.authenticated_at)
+            current_session.update!(second_factor_skipped: true) if login.skipped_second_factor?
           elsif login.signed_in? && login.touched?(:second_factor)
-            current_session.update!(amr: Array(current_session.amr) | login.amr)
+            current_session.update!(amr: Array(current_session.amr) | login.amr, second_factor_skipped: false)
           end
 
           forget_login

data/app/controllers/masks/server/organization_access_controller.rb

@@ -0,0 +1,39 @@
+module Masks
+  module Server
+    class OrganizationAccessController < OrganizationMembersController
+      def create
+        own!
+
+        asked = asked!
+        role = params[:role].to_s
+
+        asked.grant!(label: "#{@organization.key}:#{role}", by: current_actor, journey: Journey.account(current_actor))
+
+        back(notice: t("organization_access.granted", identifier: asked.actor.identifier, app: asked.client.name,
+                                                      role: role, organization: @organization.name))
+      rescue AccessRequest::Refused => e
+        back(alert: e.message)
+      end
+
+      def destroy
+        own!
+
+        asked = asked!
+        asked.decline!(by: current_actor, journey: Journey.account(current_actor))
+
+        back(notice: t("organization_access.declined", identifier: asked.actor.identifier, app: asked.client.name))
+      rescue AccessRequest::Refused => e
+        back(alert: e.message)
+      end
+
+      private
+
+        def asked!
+          id = params[:id].to_s[/\A\d+\z/]
+
+          (id && AccessRequest.for_organization(@organization).includes(:actor, :client).find_by(id: id)) ||
+            raise(AccessRequest::Refused, t("organization_access.unknown", organization: @organization.name))
+        end
+    end
+  end
+end

data/app/controllers/masks/server/organization_members_controller.rb

@@ -99,7 +99,9 @@ module Masks
         end
 
         def member!
-          @organization.memberships.includes(:actor).find_by(id: params[:id].to_s) ||
+          membership_id = params[:id].to_s[/\A\d+\z/]
+
+          (membership_id && @organization.memberships.includes(:actor).find_by(id: membership_id)) ||
             raise(Members::Refused, t("organization_members.not_a_member"))
         end
 

data/app/graphql/masks/server/manage/mutations/base_mutation.rb

@@ -102,6 +102,13 @@ module Masks
               Masks::Server::Group.find_by(key: key) || refuse!("no group keyed #{key}")
             end
 
+            def access_request!(id)
+              held = id.to_s[/\A\d+\z/] && Masks::Server::AccessRequest.open.find_by(id: id)
+
+              managed!(held.actor) && held if held
+              held || refuse!("no access request with that id is waiting")
+            end
+
             def invited!(actor)
               actor_created!(actor, invited: true)
 

data/app/graphql/masks/server/manage/mutations/create_group.rb

@@ -3,6 +3,8 @@ module Masks
     module Manage
       module Mutations
         class CreateGroup < BaseMutation
+          include GroupSource
+
           requires :security
 
           argument :key, String, description: "Lowercase letters, digits, dots, dashes, and underscores. Apps see it in the groups claim."
@@ -10,13 +12,13 @@ module Masks
 
           field :group, Types::GroupType, null: false
 
-          def resolve(key:, name:)
-            group = Masks::Server::Group.new(key: key, name: name)
+          def resolve(key:, name:, **source)
+            group = fill_source(Masks::Server::Group.new(key: key, name: name), **source)
             save!(group)
 
-            audit!(Masks::Server::Event::GROUP_CREATED, group: group.key)
+            audit!(Masks::Server::Event::GROUP_CREATED, group: group.key, source: group.source)
 
-            { group: group }
+            { group: group.reload }
           end
         end
       end

data/app/graphql/masks/server/manage/mutations/decline_access.rb

@@ -0,0 +1,27 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class DeclineAccess < BaseMutation
+          requires :security
+
+          description "Declines a waiting access request. The actor is told by email and can ask again in an hour."
+
+          argument :id, ID
+
+          field :access_request, Types::AccessRequestType, null: false
+
+          def resolve(id:)
+            asked = access_request!(id)
+
+            asked.decline!(by: viewer, journey: Masks::Server::Journey.manage(viewer))
+
+            { access_request: asked }
+          rescue Masks::Server::AccessRequest::Refused => e
+            refuse!(e.message)
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/grant_access.rb

@@ -0,0 +1,29 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class GrantAccess < BaseMutation
+          requires :security
+
+          description "Grants a waiting access request by putting the actor in one of the groups the client allows. " \
+                      "Name the group with label, or leave it out for the first one the client allows."
+
+          argument :id, ID
+          argument :label, String, required: false
+
+          field :access_request, Types::AccessRequestType, null: false
+
+          def resolve(id:, label: nil)
+            asked = access_request!(id)
+
+            asked.grant!(label: label, by: viewer, journey: Masks::Server::Journey.manage(viewer))
+
+            { access_request: asked }
+          rescue Masks::Server::AccessRequest::Refused => e
+            refuse!(e.message)
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/group_source.rb

@@ -0,0 +1,34 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        module GroupSource
+          extend ActiveSupport::Concern
+
+          included do
+            argument :source, String, required: false,
+                     description: "manual, rule, provider, or group. A sourced group fills itself and keeps anyone added by hand."
+            argument :rule, [ Types::GroupConditionInput ], required: false,
+                     description: "For rule: up to five conditions, all of which must hold."
+            argument :provider_key, String, required: false, description: "For provider: the provider whose sign-ins list groups."
+            argument :upstream_group, String, required: false, description: "For provider: the group name the provider lists."
+            argument :parent_labels, [ String ], required: false,
+                     description: "For group: group keys and organization roles, as key:role, the group holds everyone from."
+          end
+
+          private
+
+            def fill_source(group, source: nil, rule: nil, provider_key: nil, upstream_group: nil, parent_labels: nil)
+              group.source = source unless source.nil?
+              group.rule = rule.map(&:to_h) unless rule.nil?
+              group.provider = provider_key.blank? ? nil : provider!(provider_key) unless provider_key.nil?
+              group.upstream_group = upstream_group unless upstream_group.nil?
+              group.parent_labels = parent_labels unless parent_labels.nil?
+
+              group
+            end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/issue_ldap_credential.rb

@@ -8,12 +8,15 @@ module Masks
           description "Issues a bind DN and secret an app uses to search this tenant's LDAP directory. The secret is returned once."
 
           argument :label, String, description: "Lowercase letters, digits, dots, dashes, and underscores. It becomes the cn of the bind DN."
+          argument :client_id, ID, required: false,
+                   description: "The client this app is registered as. People who make an app password for that client can bind with it on a connection that bound with this credential first."
 
           field :ldap_credential, Types::LdapCredentialType, null: false
           field :secret, String, null: false
 
-          def resolve(label:)
-            credential = Masks::Server::LdapCredential.issue!(label: label, by: viewer)
+          def resolve(label:, client_id: nil)
+            client = client_id.present? ? client!(client_id) : nil
+            credential = Masks::Server::LdapCredential.issue!(label: label, by: viewer, client: client)
 
             audit!(Masks::Server::Event::LDAP_CREDENTIAL_ISSUED, label: credential.label)
 

data/app/graphql/masks/server/manage/mutations/refresh_group.rb

@@ -0,0 +1,21 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class RefreshGroup < BaseMutation
+          requires :security
+
+          description "Fills a sourced group now instead of waiting for the hourly run."
+
+          argument :key, String
+
+          field :group, Types::GroupType, null: false
+
+          def resolve(key:)
+            { group: group!(key).refresh!(by: viewer) }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/remove_group_member.rb

@@ -17,6 +17,8 @@ module Masks
             group.remove!(actor, by: viewer)
 
             { group: group }
+          rescue Masks::Server::Group::Sourced => e
+            refuse!(e.message)
           end
         end
       end

data/app/graphql/masks/server/manage/mutations/run_health_checks.rb

@@ -0,0 +1,19 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class RunHealthChecks < BaseMutation
+          requires :support
+
+          description "Runs every health check now, instead of waiting for the next scheduled run."
+
+          field :health, [ Types::HealthCheckType ], null: false
+
+          def resolve
+            { health: Masks::Server::Health.check!.sort_by(&:name) }
+          end
+        end
+      end
+    end
+  end
+end