masks-server 0.11.0 → 0.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 608910b5ec386933423f04a3596c4b5d454b38e956449ca66d762d2cd79e3e82
-  data.tar.gz: f70b574939800fdcb3407025402e39663e15f8a9c71e2dff473685147e7cf693
+  metadata.gz: 74cc1568b822c061657b6625a809deb750f5503e66fa8d0f390c7a596004953e
+  data.tar.gz: 8bdb0e298ee2c901c71f654215fd0b958d36cd6e69befa231313dd2f98a5d249
 SHA512:
-  metadata.gz: a061d6d81ac514d825d3963c466e99272d224e0250e964e8a057a8e794a7cd1f26955cd8e1cb5753eb418f8c91e5dd2d9b31b98c8bba4eb97d11d7112ce0a40b
-  data.tar.gz: c537d6afb5fc139d5e83fd92143f0eb28588f9ec1992e607209f89c5c9f59dfff3502dc0f1196a39c2a19fcec67910458494324a70e739ced310ea73f69168cb
+  metadata.gz: e0aa16a41f23221d2274bf66aac45ba8a1c20c901526cfd79905d14a229b3614921dba96c90a4ad296f69a210c8aee6d6aa11453d063d8a07cd9b1b724f13feb
+  data.tar.gz: 4c36c8378c7d459c4c4280227d36ec6f91234d3c2db47f857b8165312af340958789373497de7aa244f8c13ceb09a33415e2de40af99eed39331d1c3161b0838

data/app/controllers/masks/server/account_controller.rb

@@ -9,6 +9,9 @@ module Masks
         return redirect_to login_path if @actor.nil?
 
         @apps = Apps.held_by(@actor)
+        @app_passwords = AppPassword.live.where(actor: @actor).includes(:client).newest_first.to_a
+        @app_password_clients = AppPassword.offered(@actor)
+        @app_password = flash[:app_password]
         @launchable = Apps.launchable(@actor)
         @invitations = @actor.memberships.outstanding.joins(:organization).merge(Organization.active)
                              .includes(:organization, :invited_by).order("organizations.name").to_a

data/app/controllers/masks/server/app_passwords_controller.rb

@@ -0,0 +1,41 @@
+module Masks
+  module Server
+    class AppPasswordsController < ApplicationController
+      ANCHOR = "app-passwords".freeze
+
+      before_action :require_actor
+
+      def create
+        return unless reauthenticated!(ANCHOR, t("app_passwords.again"))
+
+        client = Client.active.find_by(client_id: params[:client_id].to_s)
+        held = AppPassword.issue!(actor: current_actor, client: client, name: params[:name])
+
+        Event.record!(Event::APP_PASSWORD_CREATED, actor: current_actor, client: client, name: held.name)
+
+        flash[:app_password] = { "name" => held.name, "app" => client.name, "secret" => held.secret }
+        redirect_to root_path(anchor: ANCHOR)
+      rescue AppPassword::Refused => e
+        redirect_to root_path(anchor: ANCHOR), alert: t("app_passwords.refused.#{e.message}", most: AppPassword::MOST)
+      end
+
+      def destroy
+        held = AppPassword.live.find_by(id: params[:id].to_s[/\A\d+\z/], actor: current_actor)
+
+        return redirect_to root_path(anchor: ANCHOR), alert: t("app_passwords.unknown") if held.nil?
+
+        held.revoke!
+
+        Event.record!(Event::APP_PASSWORD_REVOKED, actor: current_actor, client: held.client, name: held.name)
+
+        redirect_to root_path(anchor: ANCHOR), notice: t("app_passwords.revoked", name: held.name)
+      end
+
+      private
+
+        def require_actor
+          redirect_to login_path unless current_actor
+        end
+    end
+  end
+end

data/app/controllers/masks/server/authorize_controller.rb

@@ -9,6 +9,10 @@ module Masks
         refuse(bad_request(:invalid_request_object, refusal.message))
       end
 
+      rate_limit to: 1, within: 1.hour, only: :ask,
+                 by: -> { [ current_tenant.id, current_actor&.id, refused_request(params[:rid])&.client_id ].join(":") },
+                 with: -> { redirect_to authorize_refused_path(rid: params[:rid]), alert: t("authorize.error.slow_down") }
+
       def show
         authorization = Authorization.from_request(request)
 
@@ -45,7 +49,7 @@ module Masks
 
         login = advance(pending)
 
-        return redirect_to(refuse_on_masks(pending, login.refusal)) if login.refused? && !answerable?(pending)
+        return redirect_to(refuse_on_masks(pending, login.refusal)) if login.refused? && (!answerable?(pending) || askable?(pending, login))
         return answer(deny(pending, login.refusal.error, login.refusal.description)) if login.refused?
         return interaction_required(pending) if login.prompted? && pending.silent?
         return redirect_to(login.redirect_to, allow_other_host: true) if login.redirect_to.present?
@@ -55,14 +59,31 @@ module Masks
       end
 
       def refused
-        refusal = refused_request(params[:rid])&.refusal
+        pending = refused_request(params[:rid])
+        refusal = pending&.refusal
 
         return show_error("invalid_request", "that sign-in request has expired", :bad_request) if refusal.nil?
 
         @refused = true
+        @asking = asking_for(pending)
+        @waiting = @asking && AccessRequest.open.find_by(actor: current_actor, client: @asking)
+        @return_to = answerable?(pending) && pending.authorization.redirect_with(
+          issuer: issuer, error: refusal["error"], error_description: refusal["description"]
+        )
         show_error(refusal["error"], refusal["description"], :forbidden)
       end
 
+      def ask
+        pending = refused_request(params[:rid])
+        asking = pending && asking_for(pending)
+
+        return show_error("invalid_request", "that sign-in request has expired", :bad_request) if asking.nil?
+
+        AccessRequest.ask!(actor: current_actor, client: asking)
+
+        redirect_to authorize_refused_path(rid: params[:rid]), notice: t("authorize.error.asked")
+      end
+
       private
 
         def validate(authorization)
@@ -149,6 +170,16 @@ module Masks
           end
         end
 
+        def askable?(pending, login)
+          !pending.silent? && login.actor.present? && asking_for(pending, login.actor).present?
+        end
+
+        def asking_for(pending, actor = current_actor)
+          client = pending.client
+
+          client if actor && client && client.allowed_groups.any? && !client.admits?(actor)
+        end
+
         def admitted?(authorization)
           tracked(REQUESTS).key?(authorization.fingerprint)
         end

data/app/controllers/masks/server/forward_auth_controller.rb

@@ -15,13 +15,21 @@ module Masks
 
         client = Client.forwarding_to(target)
         return head(:forbidden) if client.nil?
+        return basic(client, target) if ActionController::HttpAuthentication::Basic.has_basic_credentials?(request)
 
         held = ForwardSession.held(cookies[ForwardSession::COOKIE], client)
-        return admit(held.actor) if held
-
-        return head(:unauthorized) if params[:status] == "401"
-
-        redirect_to forward_auth_start_url(rd: target.to_s), allow_other_host: true
+        decided = client.forward_rules.decide(path: target.path, method: forwarded_method, address: request.remote_ip,
+                                              actor: held&.actor)
+
+        case decided.outcome
+        when ForwardAuthRules::OPEN then admit(held&.actor)
+        when ForwardAuthRules::DENY then head(:forbidden)
+        when ForwardAuthRules::ONE_FACTOR then held ? admit(held.actor) : ask_to_sign_in(target)
+        when ForwardAuthRules::TWO_FACTOR then held&.session&.multi_factored? ? admit(held.actor) : ask_to_sign_in(target)
+        else
+          complete = held if held&.session&.complete?
+          decided.outcome == ForwardAuthRules::TOKEN ? admit_presented(client, complete) : answer(complete, target)
+        end
       end
 
       def start
@@ -29,8 +37,20 @@ module Masks
         client = Client.forwarding_to(target)
 
         return render(plain: t("forward_auth.unknown"), status: :not_found) if client.nil?
-        return redirect_to(login_path(return_to: request.fullpath)) if current_actor.nil?
-        return render(plain: t("forward_auth.not_admitted", app: client.name), status: :forbidden) unless client.admits?(current_actor)
+
+        decided = client.forward_rules.decide(path: target.path, method: "GET", address: request.remote_ip, actor: current_actor)
+
+        return render(plain: t("forward_auth.denied", app: client.name), status: :forbidden) if decided.outcome == ForwardAuthRules::DENY
+        return send_to_login(decided) if current_actor.nil?
+
+        unless client.admits?(current_actor)
+          return redirect_to(target.to_s, allow_other_host: true) if decided.outcome == ForwardAuthRules::OPEN
+
+          return render(plain: t("forward_auth.not_admitted", app: client.name), status: :forbidden)
+        end
+
+        return step_up if decided.outcome == ForwardAuthRules::TWO_FACTOR && !current_session.multi_factored?
+        return step_up if [ ForwardAuthRules::ONE_FACTOR, ForwardAuthRules::OPEN ].exclude?(decided.outcome) && !current_session.complete?
 
         code = ForwardCode.mint!(actor: current_actor, client: client, session: current_session,
                                  payload: { "return_to" => target.to_s })
@@ -67,15 +87,87 @@ module Masks
           redirect_to code.return_to, allow_other_host: true
         end
 
-        def admit(actor)
-          response.headers["Remote-User"] = actor.nickname.presence || actor.identifier
-          response.headers["Remote-Email"] = actor.email if actor.email_verified_at.present?
-          response.headers["Remote-Name"] = actor.name if actor.name.present?
-          response.headers["Remote-Groups"] = actor.group_labels.join(",")
+        def basic(client, target)
+          identifier, secret = ActionController::HttpAuthentication::Basic.user_name_and_password(request)
+          outcome = AppPasswords.authenticate(client: client, identifier: identifier, secret: secret, via: "forward_auth")
+
+          return head(:too_many_requests) if outcome.throttled?
+          return head(:unauthorized) if outcome.actor.nil?
+
+          decided = client.forward_rules.decide(path: target.path, method: forwarded_method, address: request.remote_ip,
+                                                actor: outcome.actor)
+          return head(:forbidden) if decided.outcome == ForwardAuthRules::DENY
+
+          admit(outcome.actor)
+        end
+
+        def answer(held, target)
+          held ? admit(held.actor) : ask_to_sign_in(target)
+        end
+
+        def ask_to_sign_in(target)
+          return head(:unauthorized) if params[:status] == "401"
+
+          redirect_to forward_auth_start_url(rd: target.to_s), allow_other_host: true
+        end
+
+        def send_to_login(decided)
+          Login.new(store: login_store).relax! if decided.outcome == ForwardAuthRules::ONE_FACTOR
+
+          redirect_to login_path(return_to: request.fullpath)
+        end
+
+        def step_up
+          Login.new(store: login_store).step_up!
+
+          redirect_to login_path(return_to: request.fullpath)
+        end
+
+        def admit_presented(client, held)
+          return admit(held.actor) if held
+
+          token = presented_token(client)
+          return admit(token.actor, machine: token.client) if token
+
+          response.headers["WWW-Authenticate"] = %(Bearer realm="#{client.forward_origin}")
+          head :unauthorized
+        end
+
+        def presented_token(client)
+          scheme, secret = request.authorization.to_s.split(" ", 2)
+          return nil unless scheme.to_s.casecmp?("Bearer") && secret.present?
+
+          claims = AccessToken.decode(secret.strip, issuer: issuer)
+          token = AccessToken.live.includes(:actor, :client).find_by(digest: claims["jti"])
+
+          return nil if token.nil? || token.bound? || token.client.nil?
+          return nil unless token.client_id == client.id || Array(token.audience).include?(client.forward_origin)
+          return nil if token.actor && (token.actor.suspended? || !client.admits?(token.actor))
+
+          token
+        rescue JWT::DecodeError
+          nil
+        end
+
+        def admit(actor, machine: nil)
+          if actor
+            response.headers["Remote-User"] = actor.nickname.presence || actor.identifier
+            response.headers["Remote-Email"] = actor.email if actor.email_verified_at.present?
+            response.headers["Remote-Name"] = actor.name if actor.name.present?
+            response.headers["Remote-Groups"] = actor.group_labels.join(",")
+          elsif machine
+            response.headers["Remote-User"] = machine.client_id
+            response.headers["Remote-Name"] = machine.name
+            response.headers["Remote-Groups"] = ""
+          end
 
           head :ok
         end
 
+        def forwarded_method
+          request.headers["X-Forwarded-Method"].presence || request.headers["X-Original-Method"].presence || "GET"
+        end
+
         def return_to
           raw = request.query_string[/(?:\A|&)rd=(.*)\z/m, 1].to_s
 

data/app/controllers/masks/server/logins_controller.rb

@@ -35,9 +35,9 @@ module Masks
 
       def show
         hold_return_to
-        return redirect_to after_login_path if current_actor && pending.nil?
-
         @login = run
+        return redirect_to after_login_path if current_actor && pending.nil? && !@login.stepping_up?
+
         @login.carry!(flash[:warnings]) if flash[:warnings].present?
 
         redirect_to after_login_path if @login.settled?
@@ -153,8 +153,9 @@ module Masks
           if login.touched?(:first_factor)
             sign_in(login.actor, amr: login.amr, policy: login.policy, first_factor: login.first_factored_by,
                                  authenticated_at: login.authenticated_at)
+            current_session.update!(second_factor_skipped: true) if login.skipped_second_factor?
           elsif login.signed_in? && login.touched?(:second_factor)
-            current_session.update!(amr: Array(current_session.amr) | login.amr)
+            current_session.update!(amr: Array(current_session.amr) | login.amr, second_factor_skipped: false)
           end
 
           forget_login

data/app/controllers/masks/server/organization_access_controller.rb

@@ -0,0 +1,39 @@
+module Masks
+  module Server
+    class OrganizationAccessController < OrganizationMembersController
+      def create
+        own!
+
+        asked = asked!
+        role = params[:role].to_s
+
+        asked.grant!(label: "#{@organization.key}:#{role}", by: current_actor, journey: Journey.account(current_actor))
+
+        back(notice: t("organization_access.granted", identifier: asked.actor.identifier, app: asked.client.name,
+                                                      role: role, organization: @organization.name))
+      rescue AccessRequest::Refused => e
+        back(alert: e.message)
+      end
+
+      def destroy
+        own!
+
+        asked = asked!
+        asked.decline!(by: current_actor, journey: Journey.account(current_actor))
+
+        back(notice: t("organization_access.declined", identifier: asked.actor.identifier, app: asked.client.name))
+      rescue AccessRequest::Refused => e
+        back(alert: e.message)
+      end
+
+      private
+
+        def asked!
+          id = params[:id].to_s[/\A\d+\z/]
+
+          (id && AccessRequest.for_organization(@organization).includes(:actor, :client).find_by(id: id)) ||
+            raise(AccessRequest::Refused, t("organization_access.unknown", organization: @organization.name))
+        end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/base_mutation.rb

@@ -102,6 +102,13 @@ module Masks
               Masks::Server::Group.find_by(key: key) || refuse!("no group keyed #{key}")
             end
 
+            def access_request!(id)
+              held = id.to_s[/\A\d+\z/] && Masks::Server::AccessRequest.open.find_by(id: id)
+
+              managed!(held.actor) && held if held
+              held || refuse!("no access request with that id is waiting")
+            end
+
             def invited!(actor)
               actor_created!(actor, invited: true)
 

data/app/graphql/masks/server/manage/mutations/create_group.rb

@@ -3,6 +3,8 @@ module Masks
     module Manage
       module Mutations
         class CreateGroup < BaseMutation
+          include GroupSource
+
           requires :security
 
           argument :key, String, description: "Lowercase letters, digits, dots, dashes, and underscores. Apps see it in the groups claim."
@@ -10,13 +12,13 @@ module Masks
 
           field :group, Types::GroupType, null: false
 
-          def resolve(key:, name:)
-            group = Masks::Server::Group.new(key: key, name: name)
+          def resolve(key:, name:, **source)
+            group = fill_source(Masks::Server::Group.new(key: key, name: name), **source)
             save!(group)
 
-            audit!(Masks::Server::Event::GROUP_CREATED, group: group.key)
+            audit!(Masks::Server::Event::GROUP_CREATED, group: group.key, source: group.source)
 
-            { group: group }
+            { group: group.reload }
           end
         end
       end

data/app/graphql/masks/server/manage/mutations/decline_access.rb

@@ -0,0 +1,27 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class DeclineAccess < BaseMutation
+          requires :security
+
+          description "Declines a waiting access request. The actor is told by email and can ask again in an hour."
+
+          argument :id, ID
+
+          field :access_request, Types::AccessRequestType, null: false
+
+          def resolve(id:)
+            asked = access_request!(id)
+
+            asked.decline!(by: viewer, journey: Masks::Server::Journey.manage(viewer))
+
+            { access_request: asked }
+          rescue Masks::Server::AccessRequest::Refused => e
+            refuse!(e.message)
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/grant_access.rb

@@ -0,0 +1,29 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class GrantAccess < BaseMutation
+          requires :security
+
+          description "Grants a waiting access request by putting the actor in one of the groups the client allows. " \
+                      "Name the group with label, or leave it out for the first one the client allows."
+
+          argument :id, ID
+          argument :label, String, required: false
+
+          field :access_request, Types::AccessRequestType, null: false
+
+          def resolve(id:, label: nil)
+            asked = access_request!(id)
+
+            asked.grant!(label: label, by: viewer, journey: Masks::Server::Journey.manage(viewer))
+
+            { access_request: asked }
+          rescue Masks::Server::AccessRequest::Refused => e
+            refuse!(e.message)
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/group_source.rb

@@ -0,0 +1,34 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        module GroupSource
+          extend ActiveSupport::Concern
+
+          included do
+            argument :source, String, required: false,
+                     description: "manual, rule, provider, or group. A sourced group fills itself and keeps anyone added by hand."
+            argument :rule, [ Types::GroupConditionInput ], required: false,
+                     description: "For rule: up to five conditions, all of which must hold."
+            argument :provider_key, String, required: false, description: "For provider: the provider whose sign-ins list groups."
+            argument :upstream_group, String, required: false, description: "For provider: the group name the provider lists."
+            argument :parent_labels, [ String ], required: false,
+                     description: "For group: group keys and organization roles, as key:role, the group holds everyone from."
+          end
+
+          private
+
+            def fill_source(group, source: nil, rule: nil, provider_key: nil, upstream_group: nil, parent_labels: nil)
+              group.source = source unless source.nil?
+              group.rule = rule.map(&:to_h) unless rule.nil?
+              group.provider = provider_key.blank? ? nil : provider!(provider_key) unless provider_key.nil?
+              group.upstream_group = upstream_group unless upstream_group.nil?
+              group.parent_labels = parent_labels unless parent_labels.nil?
+
+              group
+            end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/issue_ldap_credential.rb

@@ -8,12 +8,15 @@ module Masks
           description "Issues a bind DN and secret an app uses to search this tenant's LDAP directory. The secret is returned once."
 
           argument :label, String, description: "Lowercase letters, digits, dots, dashes, and underscores. It becomes the cn of the bind DN."
+          argument :client_id, ID, required: false,
+                   description: "The client this app is registered as. People who make an app password for that client can bind with it on a connection that bound with this credential first."
 
           field :ldap_credential, Types::LdapCredentialType, null: false
           field :secret, String, null: false
 
-          def resolve(label:)
-            credential = Masks::Server::LdapCredential.issue!(label: label, by: viewer)
+          def resolve(label:, client_id: nil)
+            client = client_id.present? ? client!(client_id) : nil
+            credential = Masks::Server::LdapCredential.issue!(label: label, by: viewer, client: client)
 
             audit!(Masks::Server::Event::LDAP_CREDENTIAL_ISSUED, label: credential.label)
 

data/app/graphql/masks/server/manage/mutations/refresh_group.rb

@@ -0,0 +1,21 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class RefreshGroup < BaseMutation
+          requires :security
+
+          description "Fills a sourced group now instead of waiting for the hourly run."
+
+          argument :key, String
+
+          field :group, Types::GroupType, null: false
+
+          def resolve(key:)
+            { group: group!(key).refresh!(by: viewer) }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/remove_group_member.rb

@@ -17,6 +17,8 @@ module Masks
             group.remove!(actor, by: viewer)
 
             { group: group }
+          rescue Masks::Server::Group::Sourced => e
+            refuse!(e.message)
           end
         end
       end

data/app/graphql/masks/server/manage/mutations/run_health_checks.rb

@@ -0,0 +1,19 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class RunHealthChecks < BaseMutation
+          requires :support
+
+          description "Runs every health check now, instead of waiting for the next scheduled run."
+
+          field :health, [ Types::HealthCheckType ], null: false
+
+          def resolve
+            { health: Masks::Server::Health.check!.sort_by(&:name) }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/update_client.rb

@@ -32,6 +32,8 @@ module Masks
           argument :saml_slo_url, String, required: false,
                    description: "The application's single logout URL, which receives masks' logout messages over HTTP-POST. Empty stops single logout."
           argument :consent_required, Boolean, required: false
+          argument :app_passwords, Boolean, required: false,
+                   description: "Whether people may make an app password for this client. An app password signs in over LDAP and forward auth without a second factor, for this client alone."
           argument :access_token_lifetime, Integer, required: false,
                    description: "Seconds an access token lasts, from 60 to a day. Zero goes back to an hour."
           argument :refresh_token_lifetime, Integer, required: false,
@@ -41,6 +43,10 @@ module Masks
                                 "from 300 to 400 days. Zero goes back to 90 days."
           argument :allowed_groups, [ String ], required: false,
                    description: "Group keys, or organization roles as key:role, whose people may sign in to this client. Empty lets everyone in."
+          argument :forward_auth_rules, GraphQL::Types::JSON, required: false,
+                   description: "The ordered rules forward auth follows, for an app behind a proxy only. Each rule has `paths` " \
+                                "(absolute, with * for one segment and ** for any depth), `methods`, `networks` (addresses or ranges), " \
+                                "and `groups` it covers, and an `outcome` of open, one_factor, two_factor, token, or deny. Empty removes them all."
           argument :sign_in_policy, ID, required: false
           argument :client_uri, String, required: false
           argument :logo_uri, String, required: false

data/app/graphql/masks/server/manage/mutations/update_group.rb

@@ -3,19 +3,22 @@ module Masks
     module Manage
       module Mutations
         class UpdateGroup < BaseMutation
+          include GroupSource
+
           requires :security
 
           argument :key, String
-          argument :name, String
+          argument :name, String, required: false
 
           field :group, Types::GroupType, null: false
 
-          def resolve(key:, name:)
+          def resolve(key:, name: nil, **source)
             group = group!(key)
-            group.name = name
+            group.name = name unless name.nil?
+            fill_source(group, **source)
             save!(group)
 
-            { group: group }
+            { group: group.reload }
           end
         end
       end

data/app/graphql/masks/server/manage/mutations/update_tenant.rb

@@ -30,14 +30,27 @@ module Masks
           argument :key_rotation_days, Integer, required: false,
                    description: "Days between scheduled signing key rotations, from 7 to 365. Zero leaves rotation to a manager."
 
+          argument :invitation_lifetime, Integer, required: false,
+                   description: "Seconds an invitation to an account stays valid, from an hour to 30 days. Zero goes back to 7 days."
+          argument :organization_invitation_lifetime, Integer, required: false,
+                   description: "Seconds an invitation to an organization stays open after it was last sent, from an hour to 30 days. Zero goes back to 14 days."
+          argument :password_reset_lifetime, Integer, required: false,
+                   description: "Seconds a password reset link stays valid, from 5 minutes to a day. Zero goes back to 30 minutes."
+          argument :email_verification_lifetime, Integer, required: false,
+                   description: "Seconds an email confirmation link stays valid, from an hour to 14 days. Zero goes back to 2 days."
+
           field :tenant, Types::TenantType, null: false
 
           def resolve(name: nil, dynamic_client_scopes: nil, dynamic_registration: nil,
                       named_by: nil, browsers_only: nil, blocked_agents: nil, sign_in_policy: nil,
                       suspend_after: nil, delete_after: nil, event_retention_days: nil, risky_networks: nil,
-                      accent_color: nil, key_rotation_days: nil, ldap_enabled: nil, ldap_password_only: nil)
+                      accent_color: nil, key_rotation_days: nil, ldap_enabled: nil, ldap_password_only: nil, **link_lifetimes)
             tenant = Current.tenant
 
+            link_lifetimes.compact.each do |name, seconds|
+              tenant[name] = seconds.zero? ? Masks::Server::Tenant.default_link_lifetime(name) : seconds
+            end
+
             tenant.name = name unless name.nil?
             tenant.accent_color = accent_color unless accent_color.nil?
             tenant.key_rotation_days = key_rotation_days.zero? ? nil : key_rotation_days unless key_rotation_days.nil?

data/app/graphql/masks/server/manage/types/access_request_type.rb

@@ -0,0 +1,21 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class AccessRequestType < BaseObject
+          description "An actor turned away from a client who asked for access. Granting it puts them in one of the groups the client allows."
+
+          field :id, ID, null: false
+          field :actor, ActorType, null: false
+          field :client, ClientType, null: false
+          field :label, String, description: "The group key, or organization role as key:role, the actor was put in. Null until granted."
+          field :decided_by, ActorType
+          field :granted_at, GraphQL::Types::ISO8601DateTime
+          field :declined_at, GraphQL::Types::ISO8601DateTime
+          field :open, Boolean, null: false, method: :open?, description: "True while nobody has granted or declined it."
+          field :created_at, GraphQL::Types::ISO8601DateTime, null: false
+        end
+      end
+    end
+  end
+end