masks-server 0.10.0 → 0.12.0

data/app/graphql/masks/server/manage/mutations/unenroll_client.rb

@@ -0,0 +1,28 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class UnenrollClient < BaseMutation
+          requires :security
+
+          argument :client_id, ID
+
+          field :client, Types::ClientType, null: false
+
+          def resolve(client_id:)
+            machine = client!(client_id)
+
+            refuse!("that client is not a machine an app enrolled, so archive it instead") unless machine.enrolled?
+
+            revoked = machine.unenroll!
+
+            audit!(Masks::Server::Event::CLIENT_UNENROLLED, client: machine, name: machine.name,
+                                                             enrolled_by: machine.enrolled_by.client_id, revoked: revoked)
+
+            { client: machine }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/update_client.rb

@@ -32,6 +32,8 @@ module Masks
           argument :saml_slo_url, String, required: false,
                    description: "The application's single logout URL, which receives masks' logout messages over HTTP-POST. Empty stops single logout."
           argument :consent_required, Boolean, required: false
+          argument :app_passwords, Boolean, required: false,
+                   description: "Whether people may make an app password for this client. An app password signs in over LDAP and forward auth without a second factor, for this client alone."
           argument :access_token_lifetime, Integer, required: false,
                    description: "Seconds an access token lasts, from 60 to a day. Zero goes back to an hour."
           argument :refresh_token_lifetime, Integer, required: false,
@@ -41,6 +43,10 @@ module Masks
                                 "from 300 to 400 days. Zero goes back to 90 days."
           argument :allowed_groups, [ String ], required: false,
                    description: "Group keys, or organization roles as key:role, whose people may sign in to this client. Empty lets everyone in."
+          argument :forward_auth_rules, GraphQL::Types::JSON, required: false,
+                   description: "The ordered rules forward auth follows, for an app behind a proxy only. Each rule has `paths` " \
+                                "(absolute, with * for one segment and ** for any depth), `methods`, `networks` (addresses or ranges), " \
+                                "and `groups` it covers, and an `outcome` of open, one_factor, two_factor, token, or deny. Empty removes them all."
           argument :sign_in_policy, ID, required: false
           argument :client_uri, String, required: false
           argument :logo_uri, String, required: false

data/app/graphql/masks/server/manage/mutations/update_group.rb

@@ -3,19 +3,22 @@ module Masks
     module Manage
       module Mutations
         class UpdateGroup < BaseMutation
+          include GroupSource
+
           requires :security
 
           argument :key, String
-          argument :name, String
+          argument :name, String, required: false
 
           field :group, Types::GroupType, null: false
 
-          def resolve(key:, name:)
+          def resolve(key:, name: nil, **source)
             group = group!(key)
-            group.name = name
+            group.name = name unless name.nil?
+            fill_source(group, **source)
             save!(group)
 
-            { group: group }
+            { group: group.reload }
           end
         end
       end

data/app/graphql/masks/server/manage/mutations/update_tenant.rb

@@ -30,14 +30,27 @@ module Masks
           argument :key_rotation_days, Integer, required: false,
                    description: "Days between scheduled signing key rotations, from 7 to 365. Zero leaves rotation to a manager."
 
+          argument :invitation_lifetime, Integer, required: false,
+                   description: "Seconds an invitation to an account stays valid, from an hour to 30 days. Zero goes back to 7 days."
+          argument :organization_invitation_lifetime, Integer, required: false,
+                   description: "Seconds an invitation to an organization stays open after it was last sent, from an hour to 30 days. Zero goes back to 14 days."
+          argument :password_reset_lifetime, Integer, required: false,
+                   description: "Seconds a password reset link stays valid, from 5 minutes to a day. Zero goes back to 30 minutes."
+          argument :email_verification_lifetime, Integer, required: false,
+                   description: "Seconds an email confirmation link stays valid, from an hour to 14 days. Zero goes back to 2 days."
+
           field :tenant, Types::TenantType, null: false
 
           def resolve(name: nil, dynamic_client_scopes: nil, dynamic_registration: nil,
                       named_by: nil, browsers_only: nil, blocked_agents: nil, sign_in_policy: nil,
                       suspend_after: nil, delete_after: nil, event_retention_days: nil, risky_networks: nil,
-                      accent_color: nil, key_rotation_days: nil, ldap_enabled: nil, ldap_password_only: nil)
+                      accent_color: nil, key_rotation_days: nil, ldap_enabled: nil, ldap_password_only: nil, **link_lifetimes)
             tenant = Current.tenant
 
+            link_lifetimes.compact.each do |name, seconds|
+              tenant[name] = seconds.zero? ? Masks::Server::Tenant.default_link_lifetime(name) : seconds
+            end
+
             tenant.name = name unless name.nil?
             tenant.accent_color = accent_color unless accent_color.nil?
             tenant.key_rotation_days = key_rotation_days.zero? ? nil : key_rotation_days unless key_rotation_days.nil?

data/app/graphql/masks/server/manage/types/access_request_type.rb

@@ -0,0 +1,21 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class AccessRequestType < BaseObject
+          description "An actor turned away from a client who asked for access. Granting it puts them in one of the groups the client allows."
+
+          field :id, ID, null: false
+          field :actor, ActorType, null: false
+          field :client, ClientType, null: false
+          field :label, String, description: "The group key, or organization role as key:role, the actor was put in. Null until granted."
+          field :decided_by, ActorType
+          field :granted_at, GraphQL::Types::ISO8601DateTime
+          field :declined_at, GraphQL::Types::ISO8601DateTime
+          field :open, Boolean, null: false, method: :open?, description: "True while nobody has granted or declined it."
+          field :created_at, GraphQL::Types::ISO8601DateTime, null: false
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/actor_type.rb

@@ -32,6 +32,8 @@ module Masks
           field :tokens, [ "Masks::Server::Manage::Types::TokenType" ], null: false
           field :memberships, [ "Masks::Server::Manage::Types::MembershipType" ], null: false
           field :groups, [ "Masks::Server::Manage::Types::GroupType" ], null: false
+          field :group_memberships, [ "Masks::Server::Manage::Types::GroupMemberType" ], null: false,
+                description: "Each group the person is in, with what put them there."
           field :group_labels, [ String ], null: false,
                 description: "What the groups claim carries: each group's key, and each organization role as key:role."
 
@@ -130,6 +132,10 @@ module Masks
             object.memberships.includes(:organization).joins(:organization).order("organizations.name")
           end
 
+          def group_memberships
+            object.group_members.includes(:group).joins(:group).order("groups.name")
+          end
+
           def tokens
             Masks::Server::Token.where(kind: TokenType::GRANTS, actor_id: object.id)
                    .live

data/app/graphql/masks/server/manage/types/client_type.rb

@@ -20,6 +20,10 @@ module Masks
                 description: "Seconds from a sign-in until its refresh tokens stop, however often they are used. Null is 90 days."
           field :allowed_groups, [ String ], null: false,
                 description: "Group keys, or organization roles as key:role, whose people may sign in. Empty lets everyone in."
+          field :forward_auth_rules, GraphQL::Types::JSON, null: false,
+                description: "The ordered rules forward auth follows for an app behind a proxy. Each has `paths`, `methods`, " \
+                             "`networks`, and `groups` it covers, and an `outcome` of open, one_factor, two_factor, token, or deny. " \
+                             "The first rule that covers a request decides it. With no rule, a signed-in person who may sign in is let through."
           field :namespaces, [ "Masks::Server::Manage::Types::NamespaceType" ], null: false
           field :token_endpoint_auth_method, String, null: false
           field :subject_type, String, null: false
@@ -55,6 +59,8 @@ module Masks
                 description: "Where masks posts a signed LogoutRequest when a person who signed in to this SAML application signs out, and its LogoutResponse when the application asks."
           field :require_signed_request_object, Boolean, null: false
           field :consent_required, Boolean, null: false
+          field :app_passwords, Boolean, null: false,
+                description: "Whether people may make an app password for this client, which LDAP and forward auth accept in place of their password and second factor."
           field :sign_in_policy, SignInPolicyType
           field :dynamic, Boolean, null: false
           field :approved_at, GraphQL::Types::ISO8601DateTime
@@ -63,6 +69,10 @@ module Masks
                 description: "The app that enrolled this client as one of its machines. Archiving that app archives this client."
           field :enrolled, [ ClientType ], null: false,
                 description: "The machines this app enrolled that are not archived."
+          field :last_seen_at, GraphQL::Types::ISO8601DateTime,
+                description: "When this client last got a token. Null if it never has."
+          field :access_requests, [ "Masks::Server::Manage::Types::AccessRequestType" ], null: false,
+                description: "Actors turned away from this client who asked for access and are waiting."
           field :archived_at, GraphQL::Types::ISO8601DateTime
           field :secret_expires_at, GraphQL::Types::ISO8601DateTime
           field :created_at, GraphQL::Types::ISO8601DateTime, null: false
@@ -85,6 +95,14 @@ module Masks
             object.enrolled.active.order(:name)
           end
 
+          def access_requests
+            object.access_requests.open.includes(:actor).order(:created_at)
+          end
+
+          def last_seen_at
+            Masks::Server::Token.where(kind: TokenType::GRANTS, client_id: object.id).maximum(:created_at)
+          end
+
           def tokens(limit: nil)
             Masks::Server::Token.where(kind: TokenType::GRANTS, client_id: object.id)
                    .live

data/app/graphql/masks/server/manage/types/group_condition_input.rb

@@ -0,0 +1,16 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class GroupConditionInput < GraphQL::Schema::InputObject
+          description "One condition of a group's rule."
+
+          argument :kind, String, description: "email_domain or profile."
+          argument :field, String, required: false,
+                   description: "For profile: name, given_name, family_name, middle_name, nickname, gender, zoneinfo, or locale."
+          argument :value, String, description: "The domain a verified email address ends with, or the value the profile field equals."
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/group_condition_type.rb

@@ -0,0 +1,29 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class GroupConditionType < BaseObject
+          description "One condition of a group's rule. Every condition must hold for a person to be in the group."
+
+          field :kind, String, null: false, description: "email_domain or profile."
+          field :field, String, description: "The profile field a profile condition reads."
+          field :value, String, null: false,
+                description: "The domain a verified email address ends with, or the value the profile field equals. " \
+                             "A profile condition matches only people whose profile a directory sets."
+
+          def kind
+            object["kind"]
+          end
+
+          def field
+            object["field"]
+          end
+
+          def value
+            object["value"]
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/group_member_type.rb

@@ -0,0 +1,16 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class GroupMemberType < BaseObject
+          description "A person's place in a group, and what put them there."
+
+          field :group, GroupType, null: false
+          field :actor, ActorType, null: false
+          field :sourced_by, String, description: "rule, provider, or group when the group's source put them in. Null when a manager added them by hand."
+          field :created_at, GraphQL::Types::ISO8601DateTime, null: false
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/group_type.rb

@@ -3,14 +3,26 @@ module Masks
     module Manage
       module Types
         class GroupType < BaseObject
-          description "A named set of people in the tenant. The groups claim lists the key of each group a person is in."
+          description "A named set of people in the tenant. The groups claim lists the key of each group a person is in. " \
+                      "A group fills by hand, from a rule, from a provider, or from other groups."
 
           field :key, String, null: false
           field :name, String, null: false
+          field :source, String, null: false, description: "manual, rule, provider, or group."
+          field :rule, [ GroupConditionType ], null: false, description: "The conditions a rule group checks. Empty unless the source is rule."
+          field :provider_key, String, description: "The provider a provider group reads at sign-in."
+          field :upstream_group, String, description: "The group name the provider lists for people who belong."
+          field :parent_labels, [ String ], null: false, description: "The group keys and organization roles, as key:role, a nested group holds everyone from."
+          field :refreshed_at, GraphQL::Types::ISO8601DateTime, description: "When the source last filled the group."
           field :member_count, Integer, null: false
           field :members, [ ActorType ], null: false
+          field :memberships, [ GroupMemberType ], null: false, description: "Each member with what put them in the group."
           field :created_at, GraphQL::Types::ISO8601DateTime, null: false
 
+          def provider_key
+            object.provider&.key
+          end
+
           def member_count
             object.members.count
           end
@@ -18,6 +30,10 @@ module Masks
           def members
             object.actors.order(:nickname)
           end
+
+          def memberships
+            object.members.includes(:actor).sort_by { |member| member.actor.nickname.to_s }
+          end
         end
       end
     end

data/app/graphql/masks/server/manage/types/health_check_type.rb

@@ -0,0 +1,18 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class HealthCheckType < BaseObject
+          description "The latest result of one health check. Checks run every 10 minutes."
+
+          field :name, ID, null: false, description: "jobs, worker, queue, ldap, metrics, mail, origin, domains, or keys."
+          field :status, String, null: false, description: "ok, warning, or failing."
+          field :summary, String, null: false, description: "A short word for what the check found, such as none, stale, or silent."
+          field :details, GraphQL::Types::JSON, null: false, description: "The figures and names behind the summary."
+          field :checked_at, GraphQL::Types::ISO8601DateTime, null: false
+          field :changed_at, GraphQL::Types::ISO8601DateTime, null: false, description: "When the status last changed."
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/ldap_credential_type.rb

@@ -7,6 +7,7 @@ module Masks
           field :label, String, null: false
           field :bind_dn, String, null: false, description: "The DN an app binds as, under ou=services in this tenant's directory."
           field :issued_by, ActorType
+          field :client, ClientType, description: "The client whose app passwords bind through this credential, when one was chosen."
           field :used_at, GraphQL::Types::ISO8601DateTime, description: "When an app last bound with it, to within five minutes."
           field :created_at, GraphQL::Types::ISO8601DateTime, null: false
 

data/app/graphql/masks/server/manage/types/mutation_type.rb

@@ -28,6 +28,9 @@ module Masks
           field :delete_group, mutation: Mutations::DeleteGroup
           field :add_group_member, mutation: Mutations::AddGroupMember
           field :remove_group_member, mutation: Mutations::RemoveGroupMember
+          field :grant_access, mutation: Mutations::GrantAccess
+          field :decline_access, mutation: Mutations::DeclineAccess
+          field :refresh_group, mutation: Mutations::RefreshGroup
           field :disable_code_factor, mutation: Mutations::DisableCodeFactor
           field :revoke_passkey, mutation: Mutations::RevokePasskey
           field :upload_avatar, mutation: Mutations::UploadAvatar
@@ -41,6 +44,7 @@ module Masks
           field :update_client, mutation: Mutations::UpdateClient
           field :rotate_client_secret, mutation: Mutations::RotateClientSecret
           field :archive_client, mutation: Mutations::ArchiveClient
+          field :unenroll_client, mutation: Mutations::UnenrollClient
           field :restore_client, mutation: Mutations::RestoreClient
           field :release_namespace, mutation: Mutations::ReleaseNamespace
           field :discover_provider, mutation: Mutations::DiscoverProvider
@@ -96,6 +100,7 @@ module Masks
           field :activate_signing_key, mutation: Mutations::ActivateSigningKey
           field :discard_signing_key, mutation: Mutations::DiscardSigningKey
           field :rotate_signing_key, mutation: Mutations::RotateSigningKey
+          field :run_health_checks, mutation: Mutations::RunHealthChecks
         end
       end
     end

data/app/graphql/masks/server/manage/types/query_type.rb

@@ -191,6 +191,13 @@ module Masks
 
           field :event_actions, [ EventActionType ], null: false
 
+          field :health, [ HealthCheckType ], null: false,
+                description: "The latest result of each health check for this tenant and the server it runs on. " \
+                             "Empty until the first scheduled run."
+          field :release, ReleaseType,
+                description: "The newest release when it is newer than this server. Null while the server is current, " \
+                             "or while MASKS_RELEASE_CHECK is off."
+
           LIMIT = 50
           CEILING = 200
           SPAN = 30
@@ -464,6 +471,23 @@ module Masks
             Masks::Server::Event::ACTIONS.sort
           end
 
+          def health
+            Masks::Server::HealthCheck.by_name
+          end
+
+          def release
+            found = Masks::Server::Release.available
+
+            return nil if found.nil?
+
+            {
+              version: found["version"],
+              url: found["url"],
+              operator_step: found["operator_step"] == true,
+              checked_at: Time.iso8601(found["checked_at"])
+            }
+          end
+
           private
 
             def actor_scope(search: nil, activated: nil, holds: nil, pending_approval: nil, recovery_requested: nil,

data/app/graphql/masks/server/manage/types/release_type.rb

@@ -0,0 +1,16 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class ReleaseType < BaseObject
+          description "A newer release of masks than the one this server runs."
+
+          field :version, String, null: false
+          field :url, String, null: false, description: "The release notes."
+          field :operator_step, Boolean, null: false, description: "Whether the release notes carry a line that starts with Operator:."
+          field :checked_at, GraphQL::Types::ISO8601DateTime, null: false
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/tenant_type.rb

@@ -9,7 +9,7 @@ module Masks
           field :origins, [ String ], null: false, description: "Every origin this tenant answers on, each its own issuer."
 
           def origins
-            [ object.templated_origin, object.custom_origin ].compact
+            [ object.templated_origin || object.held_origin, object.custom_origin ].compact
           end
           field :name, String, null: false
           field :named_by, String, null: false
@@ -31,6 +31,11 @@ module Masks
           def event_retention_days
             object.event_retention.in_days.round
           end
+          field :invitation_lifetime, Integer, null: false, description: "Seconds an invitation to an account stays valid."
+          field :organization_invitation_lifetime, Integer, null: false,
+                                                            description: "Seconds an invitation to an organization stays open after it was last sent."
+          field :password_reset_lifetime, Integer, null: false, description: "Seconds a password reset link stays valid."
+          field :email_verification_lifetime, Integer, null: false, description: "Seconds an email confirmation link stays valid."
           field :ldap_enabled, Boolean, null: false, description: "Whether the LDAP directory answers for this tenant.", method: :ldap?
           field :ldap_password_only, Boolean, null: false,
                                      description: "Whether a password alone binds to LDAP for an account that would otherwise need a second factor.",

data/app/helpers/masks/server/account_helper.rb

@@ -29,6 +29,10 @@ module Masks
         t("account.index.#{key}", **options)
       end
 
+      def account_access_requests(organization)
+        AccessRequest.for_organization(organization).includes(:actor, :client).order(:created_at)
+      end
+
       def account_roster(organization)
         organization.memberships.sort_by do |member|
           [ member.pending? ? 1 : 0, member.owner? ? 0 : 1, Members.label(member).to_s.downcase ]

data/app/jobs/masks/server/application_job.rb

@@ -2,6 +2,34 @@ module Masks
   module Server
     class ApplicationJob < ActiveJob::Base
       include Tenancy::Job
+
+      class Incomplete < StandardError; end
+
+      private
+
+        def each_tenant(scope = Tenant.active)
+          failed = scope.find_each.filter_map do |tenant|
+            Tenant.switch(tenant) { yield tenant }
+            nil
+          rescue StandardError => e
+            report_tenant_failure(tenant, e)
+            tenant.subdomain
+          end
+
+          JobFailures.record(self.class.name, failed)
+
+          raise Incomplete, "#{self.class.name.demodulize} failed for #{failed.join(', ')}" if failed.any?
+        end
+
+        def report_tenant_failure(tenant, error)
+          ::Rails.error.report(error, context: { tenant: tenant.subdomain, job: self.class.name })
+
+          Tenant.switch(tenant) do
+            Event.record!(Event::JOB_FAILED, by: nil, job: self.class.name.demodulize, error: error.class.name, message: error.message.to_s[0, 200])
+          end
+        rescue StandardError => e
+          ::Rails.logger.warn("#{self.class.name} could not record its failure in #{tenant.subdomain}: #{e.message}")
+        end
     end
   end
 end

data/app/jobs/masks/server/check_domain_claims_job.rb

@@ -5,9 +5,7 @@ module Masks
       across_tenants!
 
       def perform
-        Tenant.active.find_each do |tenant|
-          Tenant.switch(tenant) { check }
-        end
+        each_tenant { check }
       end
 
       private

data/app/jobs/masks/server/cleanup_job.rb

@@ -34,16 +34,15 @@ module Masks
           Members.purge_lapsed!
           Replay.where(expires_at: ...Time.current).in_batches(of: BATCH).delete_all
           ReleasedNickname.lapsed.in_batches(of: BATCH).delete_all
+          AccessRequest.lapsed.in_batches(of: BATCH).delete_all
         end
 
         def sweep_tokens(cutoff)
-          loop do
-            roots = Token.group("COALESCE(root_id, id)")
-              .having("MAX(LEAST(consumed_at, expires_at)) < ?", cutoff)
-              .limit(BATCH).pluck(Arel.sql("COALESCE(root_id, id)"))
-            break if roots.empty?
+          Token.where(root_id: nil).ended_before(cutoff).in_batches(of: BATCH) do |roots|
+            ids = roots.pluck(:id)
+            kept = Token.where(root_id: ids).where("LEAST(consumed_at, expires_at) >= ?", cutoff).distinct.pluck(:root_id)
 
-            Token.families(roots).delete_all
+            Token.families(ids - kept).delete_all
           end
 
           Token.where.not(kind: RefreshToken.sti_name).ended_before(cutoff)

data/app/jobs/masks/server/health_check_job.rb

@@ -0,0 +1,21 @@
+module Masks
+  module Server
+    class HealthCheckJob < ApplicationJob
+      queue_as :maintenance
+      across_tenants!
+
+      def perform
+        server = Health.server_results
+        failing = Hash.new { |held, name| held[name] = [] }
+
+        begin
+          each_tenant do |tenant|
+            Health.store!(server + Health.tenant_results).select(&:failing?).each { |row| failing[row.name] << tenant.subdomain }
+          end
+        ensure
+          Health.remember_all!(failing)
+        end
+      end
+    end
+  end
+end

data/app/jobs/masks/server/idle_accounts_job.rb

@@ -5,9 +5,7 @@ module Masks
       across_tenants!
 
       def perform
-        Tenant.active.idling.find_each do |tenant|
-          Tenant.switch(tenant) { IdleAccounts.sweep(tenant) }
-        end
+        each_tenant(Tenant.active.idling) { |tenant| IdleAccounts.sweep(tenant) }
       end
     end
   end

data/app/jobs/masks/server/prune_queue_job.rb

@@ -0,0 +1,19 @@
+module Masks
+  module Server
+    class PruneQueueJob < ApplicationJob
+      queue_as :maintenance
+      across_tenants!
+
+      BATCH = 500
+
+      def perform
+        return unless defined?(::SolidQueue::Job)
+
+        settings = ::Rails.configuration.masks
+
+        ::SolidQueue::Job.clear_finished_in_batches(batch_size: BATCH, finished_before: settings.finished_job_retention.ago)
+        ::SolidQueue::FailedExecution.where(created_at: ...settings.failed_job_retention.ago).discard_all_in_batches(batch_size: BATCH)
+      end
+    end
+  end
+end

data/app/jobs/masks/server/refresh_groups_job.rb

@@ -0,0 +1,18 @@
+module Masks
+  module Server
+    class RefreshGroupsJob < ApplicationJob
+      queue_as :maintenance
+      across_tenants!
+
+      def perform
+        each_tenant { refresh }
+      end
+
+      private
+
+        def refresh
+          Group.sourced.find_each(&:refresh!)
+        end
+    end
+  end
+end

data/app/jobs/masks/server/refresh_saml_metadata_job.rb

@@ -5,9 +5,7 @@ module Masks
       across_tenants!
 
       def perform
-        Tenant.active.find_each do |tenant|
-          Tenant.switch(tenant) { refresh }
-        end
+        each_tenant { refresh }
       end
 
       private

data/app/jobs/masks/server/release_check_job.rb

@@ -0,0 +1,21 @@
+module Masks
+  module Server
+    class ReleaseCheckJob < ApplicationJob
+      queue_as :maintenance
+      across_tenants!
+
+      def perform
+        return unless ::Rails.configuration.masks.release_check
+
+        found = Release.check!
+
+        return if found.nil?
+
+        each_tenant do
+          Event.record!(Event::RELEASE_AVAILABLE, by: nil, version: found["version"], url: found["url"],
+                                                  operator_step: found["operator_step"])
+        end
+      end
+    end
+  end
+end

data/app/jobs/masks/server/rotate_signing_keys_job.rb

@@ -7,9 +7,7 @@ module Masks
       PUBLISHED_FOR = 1.day
 
       def perform
-        Tenant.active.where.not(key_rotation_days: nil).find_each do |tenant|
-          Tenant.switch(tenant) { advance(tenant) }
-        end
+        each_tenant(Tenant.active.where.not(key_rotation_days: nil)) { |tenant| advance(tenant) }
       end
 
       private