masks-server 0.10.0 → 0.12.0

data/app/jobs/masks/server/text_job.rb

@@ -3,7 +3,11 @@ module Masks
     class TextJob < ApplicationJob
       queue_as :mailers
 
-      retry_on Sender::Failed, wait: :polynomially_longer, attempts: 3
+      ATTEMPTS = 3
+
+      retry_on Sender::Failed, wait: :polynomially_longer, attempts: ATTEMPTS do |job, error|
+        job.gave_up!(error)
+      end
 
       def perform(to, body)
         sender = Current.tenant&.sms_sender
@@ -12,6 +16,13 @@ module Masks
 
         sender.deliver(to: to, body: body)
       end
+
+      def gave_up!(error)
+        Tenant.switch(held_tenant) do
+          Event.record!(Event::TEXT_UNDELIVERED, actor: nil, by: nil, device: nil, ip_address: nil, user_agent: nil,
+                                                 said: error.message)
+        end
+      end
     end
   end
 end

data/app/ldap/masks/server/ldap/connection.rb

@@ -58,7 +58,7 @@ module Masks
 
           def bind(message)
             request = message.operation
-            @bound = nil
+            previous, @bound = @bound, nil
 
             if request.version != 3
               return write(Protocol.bind_response(message.id, Protocol::PROTOCOL_ERROR, "only LDAPv3 is spoken here"))
@@ -68,7 +68,8 @@ module Masks
               return write(Protocol.bind_response(message.id, Protocol::AUTH_METHOD_NOT_SUPPORTED, "only simple binds are supported"))
             end
 
-            outcome = Gate.new(ip_address: @ip_address).bind(request.name, request.password)
+            outcome = Gate.new(ip_address: @ip_address, client_id: previous&.service? ? previous.client_id : nil)
+                          .bind(request.name, request.password)
             @bound = outcome.bound
 
             write(Protocol.bind_response(message.id, outcome.code, outcome.message))

data/app/ldap/masks/server/ldap/gate.rb

@@ -5,7 +5,11 @@ module Masks
         WINDOW = 3.minutes
         VIA = "ldap".freeze
 
-        Bound = Data.define(:kind, :tenant, :dn, :subject) do
+        Bound = Data.define(:kind, :tenant, :dn, :subject, :client_id) do
+          def initialize(client_id: nil, **rest)
+            super(client_id: client_id, **rest)
+          end
+
           def service?
             kind == :service
           end
@@ -17,8 +21,9 @@ module Masks
 
         Outcome = Data.define(:code, :message, :bound)
 
-        def initialize(ip_address:)
+        def initialize(ip_address:, client_id: nil)
           @ip_address = ip_address
+          @client_id = client_id
         end
 
         def bind(name, password)
@@ -80,7 +85,8 @@ module Masks
 
             Outcome.new(
               code: Protocol::SUCCESS, message: "",
-              bound: Bound.new(kind: :service, tenant: tenant, dn: directory.service_dn(credential.label), subject: credential.id)
+              bound: Bound.new(kind: :service, tenant: tenant, dn: directory.service_dn(credential.label), subject: credential.id,
+                               client_id: credential.client_id)
             )
           end
 
@@ -93,6 +99,7 @@ module Masks
             end
 
             actor = Actor.authenticate(uid, password)
+            return app_password(tenant, directory, uid, password, account) if actor.nil? && app_password?(password)
 
             if actor.nil?
               failed!(ip_key, account)
@@ -103,8 +110,28 @@ module Masks
             return refuse(uid, reason, actor) if reason
 
             actor.active!
+            bound(tenant, directory, actor)
+          end
+
+          def app_password?(password)
+            @client_id && AppPassword.shaped?(password)
+          end
+
+          def app_password(tenant, directory, uid, password, account)
+            client = Client.active.find_by(id: @client_id)
+            outcome = AppPasswords.authenticate(client: client, identifier: uid, secret: password, via: VIA,
+                                                ip_address: @ip_address, tenant: tenant)
+
+            return throttled if outcome.throttled?
+            return bound(tenant, directory, outcome.actor, factor: AppPasswords::FACTOR) if outcome.actor
+
+            failed!(ip_key, account) if outcome.wrong?
+            invalid
+          end
+
+          def bound(tenant, directory, actor, factor: "password")
             dn = directory.person_dn(actor)
-            Event.record!(Event::LDAP_BOUND, actor: actor, dn: dn.to_s)
+            Event.record!(Event::LDAP_BOUND, actor: actor, dn: dn.to_s, factor: factor)
 
             Outcome.new(code: Protocol::SUCCESS, message: "", bound: Bound.new(kind: :person, tenant: tenant, dn: dn, subject: actor.id))
           end

data/app/logins/masks/server/login_states/second_factor.rb

@@ -11,7 +11,7 @@ module Masks
         end
 
         prompts "second-factor" do
-          login.first_factored? && !login.second_factored?
+          login.first_factored? && !login.second_factored? && !login.relaxed?
         end
 
         def factor!

data/app/mailers/masks/server/actor_mailer.rb

@@ -160,6 +160,37 @@ module Masks
         )
       end
 
+      def access_granted(asked, journey:)
+        return message unless deliverable?
+
+        journey!(journey)
+        @actor = asked.actor
+        @app = asked.client
+        @url = (@app.approved? && @app.client_uri.presence) || home
+
+        mail(
+          from: self.class.from,
+          to: @actor.email,
+          subject: customize!(:access_granted, actor: @actor, app: @app.name,
+                                               default: t("actor_mailer.access_granted.subject", app: @app.name))
+        )
+      end
+
+      def access_declined(asked, journey:)
+        return message unless deliverable?
+
+        journey!(journey)
+        @actor = asked.actor
+        @app = asked.client
+
+        mail(
+          from: self.class.from,
+          to: @actor.email,
+          subject: customize!(:access_declined, actor: @actor, app: @app.name,
+                                                default: t("actor_mailer.access_declined.subject", app: @app.name))
+        )
+      end
+
       private
 
         def tenant_lede(manager)

data/app/models/masks/server/access_request.rb

@@ -0,0 +1,103 @@
+module Masks
+  module Server
+    class AccessRequest < ApplicationRecord
+      include TenantScoped
+
+      class Refused < StandardError; end
+
+      LIFETIME = 30.days
+
+      belongs_to :actor
+      belongs_to :client
+      belongs_to :decided_by, class_name: "Actor", optional: true
+
+      scope :open, -> { where(granted_at: nil, declined_at: nil) }
+      scope :lapsed, -> { where(created_at: ...LIFETIME.ago) }
+      scope :newest_first, -> { order(created_at: :desc) }
+
+      class << self
+        def ask!(actor:, client:)
+          return nil if client.admits?(actor)
+
+          open.find_by(actor: actor, client: client) || begin
+            created = create!(actor: actor, client: client)
+            Event.record!(Event::ACCESS_REQUESTED, actor: actor, client: client)
+            created
+          end
+        rescue ActiveRecord::RecordNotUnique
+          open.find_by!(actor: actor, client: client)
+        end
+
+        def for_organization(organization)
+          open.joins(:client).where("EXISTS (SELECT 1 FROM unnest(clients.allowed_groups) AS held WHERE held LIKE ?)",
+                                   "#{sanitize_sql_like(organization.key)}:%")
+        end
+      end
+
+      def open?
+        granted_at.nil? && declined_at.nil?
+      end
+
+      def grant!(label: nil, by:, journey:)
+        raise Refused, "#{actor.identifier} is already admitted to #{client.name}" if client.admits?(actor)
+        raise Refused, "this request is already decided" unless open?
+
+        chosen = label.presence || client.allowed_groups.first
+        raise Refused, "#{chosen} is not one of the groups #{client.name} allows" unless client.allowed_groups.include?(chosen)
+
+        transaction do
+          admit!(chosen, by: by)
+          update!(granted_at: Time.current, decided_by: by, label: chosen)
+          Event.record!(Event::ACCESS_GRANTED, actor: actor, by: by, client: client, label: chosen)
+        end
+
+        ActorMailer.access_granted(self, journey: journey).deliver_later if actor.email.present?
+
+        self
+      end
+
+      def decline!(by:, journey:)
+        raise Refused, "this request is already decided" unless open?
+
+        transaction do
+          update!(declined_at: Time.current, decided_by: by)
+          Event.record!(Event::ACCESS_DECLINED, actor: actor, by: by, client: client)
+        end
+
+        ActorMailer.access_declined(self, journey: journey).deliver_later if actor.email.present?
+
+        self
+      end
+
+      def organization_roles
+        client.allowed_groups.filter_map do |held|
+          key, role = held.split(":", 2)
+          [ key, role ] if role
+        end
+      end
+
+      private
+
+        def admit!(label, by:)
+          key, role = label.split(":", 2)
+
+          if role.nil?
+            group = Group.find_by(key: key) || raise(Refused, "there is no group keyed #{key}")
+            group.add!(actor, by: by)
+          else
+            organization = Organization.active.find_by(key: key) || raise(Refused, "there is no organization keyed #{key}")
+            held = organization.memberships.find_by(actor: actor)
+            held = held.destroy! && nil if held&.pending?
+
+            if held.nil?
+              Members.enroll!(organization, actor, role: role, by: by)
+            elsif held.role != role
+              Members.assign!(held, role: role, by: by)
+            end
+          end
+        rescue Members::Refused => e
+          raise Refused, e.message
+        end
+    end
+  end
+end

data/app/models/masks/server/actor.rb

@@ -30,6 +30,7 @@ module Masks
       has_many :approvals, class_name: "Client", foreign_key: :approved_by_id, dependent: :nullify
       has_one :avatar, dependent: :destroy
       has_many :group_members, dependent: :delete_all
+      has_many :access_requests, dependent: :delete_all
       has_many :groups, through: :group_members
 
       before_destroy :sign_out_everywhere!, prepend: true
@@ -61,6 +62,7 @@ module Masks
       after_save :release_previous_nickname, if: :saved_change_to_nickname?
       before_save :forget_code_factors_for_new_addresses
       after_update :forget_mailed_links, if: :saved_change_to_email?
+      after_commit :settle_sourced_groups, on: %i[create update], if: -> { saved_changes.keys.intersect?(Group::WATCHED) }
 
       normalizes :nickname, with: ->(value) { value.to_s.strip.presence }
       normalizes :email, with: ->(value) { value.to_s.strip.downcase.presence }
@@ -469,6 +471,10 @@ module Masks
 
       private
 
+        def settle_sourced_groups
+          Group.ruled.find_each { |group| group.settle!(self) }
+        end
+
         def forget_mailed_links
           [ PasswordReset, Invitation, EmailVerification ].each do |kind|
             kind.where(actor_id: id).live.find_each(&:consume!)

data/app/models/masks/server/app_password.rb

@@ -0,0 +1,91 @@
+module Masks
+  module Server
+    class AppPassword < Token
+      ALPHABET = "abcdefghjkmnpqrstuvwxyz23456789".freeze
+      LENGTH = 24
+      GROUP = 4
+      LIFETIME = 100.years
+      NAME_LIMIT = 64
+      MOST = 20
+      USED_GRAIN = 1.minute
+
+      class Refused < StandardError; end
+
+      scope :newest_first, -> { order(created_at: :desc) }
+
+      class << self
+        def offered(actor)
+          Client.active.where(app_passwords: true).order(:name).select { |client| client.admits?(actor) }
+        end
+
+        def issue!(actor:, client:, name:)
+          label = name.to_s.strip
+
+          raise Refused, "name" if label.empty? || label.length > NAME_LIMIT
+          raise Refused, "app" if client.nil? || offered(actor).none? { |offered| offered.id == client.id }
+          raise Refused, "too_many" if live.where(actor: actor).count >= MOST
+
+          secret = Array.new(LENGTH) { ALPHABET[SecureRandom.random_number(ALPHABET.length)] }.join
+          held = create!(actor: actor, client: client, digest: BCrypt::Password.create(secret, cost: cost),
+                         payload: { "name" => label }, expires_at: LIFETIME.from_now)
+          held.instance_variable_set(:@secret, grouped(secret))
+          held
+        end
+
+        def normalize(secret)
+          secret.to_s.downcase.delete("- ")
+        end
+
+        def shaped?(secret)
+          offered = normalize(secret)
+
+          offered.length == LENGTH && offered.each_char.all? { |char| ALPHABET.include?(char) }
+        end
+
+        def check(actor:, client:, secret:)
+          offered = normalize(secret)
+          return burn(offered) unless actor && client && shaped?(offered)
+
+          found = live.where(actor: actor, client: client).to_a.find { |held| BCrypt::Password.new(held.digest) == offered }
+
+          found || burn(offered)
+        end
+
+        def grouped(secret)
+          secret.scan(/.{1,#{GROUP}}/o).join("-")
+        end
+
+        private
+
+          def cost
+            ActiveModel::SecurePassword.min_cost ? BCrypt::Engine::MIN_COST : BCrypt::Engine.cost
+          end
+
+          def burn(secret)
+            BCrypt::Password.new(Actor.decoy_digest) == secret
+            nil
+          end
+      end
+
+      def name
+        held("name")
+      end
+
+      def used_at
+        held("used_at")&.then { |value| Time.zone.parse(value) }
+      end
+
+      def used!
+        return if used_at && used_at > USED_GRAIN.ago
+
+        now = Time.current
+        today = now.to_date.iso8601
+        first_today = held("used_on") != today
+
+        update_columns(payload: (payload || {}).merge("used_at" => now.iso8601, "used_on" => today))
+
+        Event.record!(Event::APP_PASSWORD_USED, actor: actor, client: client, name: name) if first_today
+      end
+    end
+  end
+end

data/app/models/masks/server/app_passwords.rb

@@ -0,0 +1,82 @@
+module Masks
+  module Server
+    module AppPasswords
+      FACTOR = "app_password".freeze
+      THROTTLED = "throttled".freeze
+      WINDOW = 3.minutes
+      SCOPE = "masks/server/logins".freeze
+
+      Outcome = Data.define(:actor, :refusal) do
+        def throttled?
+          refusal == THROTTLED
+        end
+
+        def wrong?
+          refusal == FACTOR
+        end
+      end
+
+      class << self
+        def authenticate(client:, identifier:, secret:, via:, ip_address: Current.ip_address, tenant: Current.tenant)
+          return refused(nil, identifier, "factor-not-offered", via, client) unless client&.app_passwords? && !client.archived?
+
+          actor = Actor.locate(identifier)
+          keys = [ account_key(tenant, actor, identifier), address_key(tenant, ip_address) ]
+
+          if throttled?(keys)
+            Event.record!(Event::LOGIN_THROTTLED, actor: actor, by: nil, client: client, identifier: identifier, via: via)
+            return Outcome.new(actor: nil, refusal: THROTTLED)
+          end
+
+          held = AppPassword.check(actor: actor, client: client, secret: secret)
+
+          if held.nil?
+            failed!(keys)
+            return refused(actor, identifier, FACTOR, via, client)
+          end
+
+          reason = obstacle(client, actor)
+          return refused(actor, identifier, reason, via, client) if reason
+
+          actor.active!
+          held.used!
+
+          Outcome.new(actor: actor, refusal: nil)
+        end
+
+        private
+
+          def obstacle(client, actor)
+            return "suspended" if actor.suspended?
+            return "pending_approval" if actor.pending_approval_at.present?
+
+            "not_admitted" unless client.admits?(actor)
+          end
+
+          def refused(actor, identifier, factor, via, client)
+            Event.record!(Event::LOGIN_REFUSED, actor: actor, by: nil, client: client, factor: factor, identifier: identifier, via: via)
+
+            Outcome.new(actor: nil, refusal: factor)
+          end
+
+          def account_key(tenant, actor, identifier)
+            [ "rate-limit", SCOPE, "identifier", tenant.id, actor&.id || identifier.to_s.strip.downcase ].join(":")
+          end
+
+          def address_key(tenant, ip_address)
+            [ "rate-limit", SCOPE, tenant.id, ip_address ].join(":")
+          end
+
+          def throttled?(keys)
+            limits = [ ::Rails.configuration.masks.account_attempt_limit, ::Rails.configuration.masks.attempt_limit ]
+
+            keys.zip(limits).any? { |key, limit| ::Rails.cache.read(key).to_i >= limit }
+          end
+
+          def failed!(keys)
+            keys.each { |key| ::Rails.cache.increment(key, 1, expires_in: WINDOW) }
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/app_preset.rb

@@ -182,6 +182,108 @@ module Masks
             [ "OAUTH_PROVIDER_NAME", "{tenant}" ], [ "ENABLE_OAUTH_SIGNUP", "true" ],
             [ "ENABLE_OAUTH_ROLE_MANAGEMENT", "true" ], [ "OAUTH_ROLES_CLAIM", "groups" ], [ "OAUTH_ADMIN_ROLES", "admins" ]
           ]
+        },
+        {
+          key: "tailscale", name: "Tailscale",
+          redirects: [ "https://login.tailscale.com/a/oauth_response" ],
+          scopes: %w[openid profile email],
+          guide: "https://tailscale.com/kb/1240/sso-custom-oidc",
+          settings: [
+            [ "WebFinger domain", "{masks_host}" ], [ "Issuer URL", "{issuer}" ],
+            [ "Client ID", "{client_id}" ], [ "Client secret", "{client_secret}" ]
+          ]
+        },
+        {
+          key: "headscale", name: "Headscale",
+          redirects: [ "{base}/oidc/callback" ],
+          scopes: %w[openid profile email groups],
+          guide: "https://headscale.net/stable/ref/oidc/",
+          settings: [
+            [ "oidc.issuer", "{issuer}" ], [ "oidc.client_id", "{client_id}" ], [ "oidc.client_secret", "{client_secret}" ],
+            [ "oidc.scope", "[openid, profile, email, groups]" ], [ "oidc.allowed_groups", "[admins]" ]
+          ]
+        },
+        {
+          key: "home-assistant", name: "Home Assistant (OIDC integration)",
+          redirects: [ "{base}/auth/oidc/callback" ],
+          scopes: %w[openid profile email groups],
+          guide: "https://github.com/christiaangoossens/hass-oidc-auth",
+          settings: [
+            [ "auth_oidc.discovery_url", "{discovery}" ], [ "auth_oidc.client_id", "{client_id}" ],
+            [ "auth_oidc.client_secret", "{client_secret}" ], [ "auth_oidc.display_name", "{tenant}" ],
+            [ "auth_oidc.roles.admin", "admins" ]
+          ]
+        },
+        {
+          key: "synapse", name: "Matrix (Synapse)", asks: { "name" => "masks" },
+          redirects: [ "{base}/_synapse/client/oidc/callback" ],
+          scopes: %w[openid profile email],
+          guide: "https://element-hq.github.io/synapse/latest/openid.html",
+          settings: [
+            [ "oidc_providers", "- idp_id: {name}\n  idp_name: {tenant}\n  issuer: {issuer}\n  client_id: {client_id}\n" \
+                                "  client_secret: {client_secret}\n  scopes: [openid, profile, email]\n" \
+                                "  user_mapping_provider:\n    config:\n      localpart_template: \"{{ user.preferred_username }}\"\n" \
+                                "      display_name_template: \"{{ user.name }}\"\n      email_template: \"{{ user.email }}\"" ]
+          ]
+        },
+        {
+          key: "bookstack", name: "BookStack",
+          redirects: [ "{base}/oidc/callback" ],
+          scopes: %w[openid profile email groups],
+          guide: "https://www.bookstackapp.com/docs/admin/oidc-auth/",
+          settings: [
+            [ "AUTH_METHOD", "oidc" ], [ "OIDC_NAME", "{tenant}" ], [ "OIDC_ISSUER", "{issuer}" ], [ "OIDC_ISSUER_DISCOVER", "true" ],
+            [ "OIDC_CLIENT_ID", "{client_id}" ], [ "OIDC_CLIENT_SECRET", "{client_secret}" ],
+            [ "OIDC_DISPLAY_NAME_CLAIMS", "name" ], [ "OIDC_ADDITIONAL_SCOPES", "groups" ],
+            [ "OIDC_USER_TO_GROUPS", "true" ], [ "OIDC_GROUPS_CLAIM", "groups" ], [ "OIDC_REMOVE_FROM_GROUPS", "true" ]
+          ]
+        },
+        {
+          key: "wikijs", name: "Wiki.js", asks: { "name" => "masks" },
+          redirects: [ "{base}/login/{name}/callback" ],
+          scopes: %w[openid profile email groups],
+          guide: "https://docs.requarks.io/auth/oidc",
+          settings: [
+            [ "Client ID", "{client_id}" ], [ "Client Secret", "{client_secret}" ],
+            [ "Authorization Endpoint URL", "{authorize}" ], [ "Token Endpoint URL", "{token}" ],
+            [ "User Info Endpoint URL", "{userinfo}" ], [ "Issuer", "{issuer}" ], [ "Logout URL", "{logout}" ],
+            [ "Email Claim", "email" ], [ "Display Name Claim", "name" ], [ "Groups Claim", "groups" ],
+            [ "Callback URL", "{base}/login/{name}/callback" ]
+          ]
+        },
+        {
+          key: "minio", name: "MinIO",
+          redirects: [ "{base}/oauth_callback" ],
+          scopes: %w[openid profile email groups],
+          guide: "https://min.io/docs/minio/linux/operations/external-iam/configure-openid-external-identity-management.html",
+          settings: [
+            [ "MINIO_IDENTITY_OPENID_CONFIG_URL", "{discovery}" ], [ "MINIO_IDENTITY_OPENID_CLIENT_ID", "{client_id}" ],
+            [ "MINIO_IDENTITY_OPENID_CLIENT_SECRET", "{client_secret}" ], [ "MINIO_IDENTITY_OPENID_SCOPES", "openid,profile,email,groups" ],
+            [ "MINIO_IDENTITY_OPENID_CLAIM_NAME", "groups" ], [ "MINIO_IDENTITY_OPENID_REDIRECT_URI", "{base}/oauth_callback" ],
+            [ "MINIO_IDENTITY_OPENID_DISPLAY_NAME", "{tenant}" ]
+          ]
+        },
+        {
+          key: "argocd", name: "Argo CD",
+          redirects: [ "{base}/auth/callback", "{base}/api/dex/callback" ],
+          scopes: %w[openid profile email groups],
+          guide: "https://argo-cd.readthedocs.io/en/stable/operator-manual/user-management/#existing-oidc-provider",
+          settings: [
+            [ "argocd-cm oidc.config", "name: {tenant}\nissuer: {issuer}\nclientID: {client_id}\nclientSecret: {client_secret}\n" \
+                                       "requestedScopes: [openid, profile, email, groups]" ],
+            [ "argocd-rbac-cm policy.csv", "g, admins, role:admin" ], [ "argocd-rbac-cm scopes", "[groups]" ]
+          ]
+        },
+        {
+          key: "synology", name: "Synology DSM",
+          redirects: [ "{base}", "{base}/" ],
+          scopes: %w[openid profile email],
+          guide: "https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/connection_sso_client",
+          settings: [
+            [ "Profile", "OIDC" ], [ "Name", "{tenant}" ], [ "Well Known URL", "{discovery}" ],
+            [ "Client ID", "{client_id}" ], [ "Client secret", "{client_secret}" ],
+            [ "Scope", "openid profile email" ], [ "Username claim", "preferred_username" ], [ "Redirect URI", "{base}" ]
+          ]
         }
       ].map(&:freeze).freeze
 

data/app/models/masks/server/boot_task.rb

@@ -0,0 +1,41 @@
+require "socket"
+require "zlib"
+
+module Masks
+  module Server
+    class BootTask
+      WINDOW = 10.minutes
+
+      Outcome = Struct.new(:name, :host, :value, :done) do
+        def done? = done
+      end
+
+      class << self
+        def once(name, fingerprint: nil)
+          key = "masks:boot:#{name}:#{Digest::SHA256.hexdigest(fingerprint.to_s)[0, 16]}"
+          host = Socket.gethostname
+          outcome = nil
+
+          ActiveRecord::Base.transaction do
+            ActiveRecord::Base.connection.execute("SELECT pg_advisory_xact_lock(#{lock_id(name)})")
+            done_by = ::Rails.cache.read(key)
+
+            if done_by
+              outcome = Outcome.new(name, done_by, nil, false)
+            else
+              value = yield
+              ::Rails.cache.write(key, host, expires_in: WINDOW)
+              outcome = Outcome.new(name, host, value, true)
+            end
+          end
+
+          outcome
+        end
+
+        def lock_id(name)
+          Zlib.crc32("masks:boot:#{name}")
+        end
+      end
+    end
+  end
+end

data/app/models/masks/server/client.rb

@@ -54,6 +54,7 @@ module Masks
       has_many :consents, dependent: :destroy
       has_many :delegations, dependent: :destroy
       has_many :saml_participations, dependent: :delete_all
+      has_many :access_requests, dependent: :delete_all
       has_many :namespaces, -> { order(:name) }, dependent: :nullify
       has_many :enrolled, class_name: "Client", foreign_key: :enrolled_by_id, inverse_of: :enrolled_by,
                           dependent: :nullify
@@ -73,6 +74,7 @@ module Masks
       validate :keys_are_usable
       validate :saml_is_described, if: :saml?
       validate :forward_is_described, if: :forward?
+      validate :forward_auth_rules_are_usable
       validate :backchannel_logout_uri_is_usable
       validate :sector_is_derivable
       validate :consent_is_skipped_only_when_approved
@@ -89,6 +91,7 @@ module Masks
 
       normalizes :allowed_groups, with: ->(value) { Array(value).map { |group| group.to_s.strip.downcase }.compact_blank.uniq.sort }
       normalizes :saml_entity_id, :saml_slo_url, with: ->(value) { value.to_s.strip.presence }
+      normalizes :forward_auth_rules, with: ->(value) { ForwardAuthRules.normalize(value) }
       normalizes(*METADATA_URIS, with: ->(value) { value.to_s.strip.presence })
 
       after_commit :refresh_logo!, on: %i[create update], if: :saved_change_to_logo_uri?
@@ -464,6 +467,10 @@ module Masks
         allowed_groups.empty? || actor.group_labels.intersect?(allowed_groups)
       end
 
+      def forward_rules
+        ForwardAuthRules.new(forward_auth_rules)
+      end
+
       def permitted_scopes(requested)
         return scope_list if Scopes.list(requested).empty?
 
@@ -604,6 +611,14 @@ module Masks
           errors.add(:grant_types, "not supported: #{unknown.join(', ')}") if unknown.any?
         end
 
+        def forward_auth_rules_are_usable
+          held = forward_auth_rules
+
+          return errors.add(:base, "forward auth rules apply only to an app behind a proxy") if held.present? && !forward?
+
+          ForwardAuthRules.problems(held).each { |problem| errors.add(:base, problem) }
+        end
+
         def forward_is_described
           errors.add(:grant_types, "are not used by an app behind a proxy") if grant_types.any?
           errors.add(:token_endpoint_auth_method, "is none for an app behind a proxy") unless public?