masks-server 0.11.0 → 0.12.0

data/app/graphql/masks/server/manage/types/actor_type.rb

@@ -32,6 +32,8 @@ module Masks
           field :tokens, [ "Masks::Server::Manage::Types::TokenType" ], null: false
           field :memberships, [ "Masks::Server::Manage::Types::MembershipType" ], null: false
           field :groups, [ "Masks::Server::Manage::Types::GroupType" ], null: false
+          field :group_memberships, [ "Masks::Server::Manage::Types::GroupMemberType" ], null: false,
+                description: "Each group the person is in, with what put them there."
           field :group_labels, [ String ], null: false,
                 description: "What the groups claim carries: each group's key, and each organization role as key:role."
 
@@ -130,6 +132,10 @@ module Masks
             object.memberships.includes(:organization).joins(:organization).order("organizations.name")
           end
 
+          def group_memberships
+            object.group_members.includes(:group).joins(:group).order("groups.name")
+          end
+
           def tokens
             Masks::Server::Token.where(kind: TokenType::GRANTS, actor_id: object.id)
                    .live

data/app/graphql/masks/server/manage/types/client_type.rb

@@ -20,6 +20,10 @@ module Masks
                 description: "Seconds from a sign-in until its refresh tokens stop, however often they are used. Null is 90 days."
           field :allowed_groups, [ String ], null: false,
                 description: "Group keys, or organization roles as key:role, whose people may sign in. Empty lets everyone in."
+          field :forward_auth_rules, GraphQL::Types::JSON, null: false,
+                description: "The ordered rules forward auth follows for an app behind a proxy. Each has `paths`, `methods`, " \
+                             "`networks`, and `groups` it covers, and an `outcome` of open, one_factor, two_factor, token, or deny. " \
+                             "The first rule that covers a request decides it. With no rule, a signed-in person who may sign in is let through."
           field :namespaces, [ "Masks::Server::Manage::Types::NamespaceType" ], null: false
           field :token_endpoint_auth_method, String, null: false
           field :subject_type, String, null: false
@@ -55,6 +59,8 @@ module Masks
                 description: "Where masks posts a signed LogoutRequest when a person who signed in to this SAML application signs out, and its LogoutResponse when the application asks."
           field :require_signed_request_object, Boolean, null: false
           field :consent_required, Boolean, null: false
+          field :app_passwords, Boolean, null: false,
+                description: "Whether people may make an app password for this client, which LDAP and forward auth accept in place of their password and second factor."
           field :sign_in_policy, SignInPolicyType
           field :dynamic, Boolean, null: false
           field :approved_at, GraphQL::Types::ISO8601DateTime
@@ -65,6 +71,8 @@ module Masks
                 description: "The machines this app enrolled that are not archived."
           field :last_seen_at, GraphQL::Types::ISO8601DateTime,
                 description: "When this client last got a token. Null if it never has."
+          field :access_requests, [ "Masks::Server::Manage::Types::AccessRequestType" ], null: false,
+                description: "Actors turned away from this client who asked for access and are waiting."
           field :archived_at, GraphQL::Types::ISO8601DateTime
           field :secret_expires_at, GraphQL::Types::ISO8601DateTime
           field :created_at, GraphQL::Types::ISO8601DateTime, null: false
@@ -87,6 +95,10 @@ module Masks
             object.enrolled.active.order(:name)
           end
 
+          def access_requests
+            object.access_requests.open.includes(:actor).order(:created_at)
+          end
+
           def last_seen_at
             Masks::Server::Token.where(kind: TokenType::GRANTS, client_id: object.id).maximum(:created_at)
           end

data/app/graphql/masks/server/manage/types/group_condition_input.rb

@@ -0,0 +1,16 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class GroupConditionInput < GraphQL::Schema::InputObject
+          description "One condition of a group's rule."
+
+          argument :kind, String, description: "email_domain or profile."
+          argument :field, String, required: false,
+                   description: "For profile: name, given_name, family_name, middle_name, nickname, gender, zoneinfo, or locale."
+          argument :value, String, description: "The domain a verified email address ends with, or the value the profile field equals."
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/group_condition_type.rb

@@ -0,0 +1,29 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class GroupConditionType < BaseObject
+          description "One condition of a group's rule. Every condition must hold for a person to be in the group."
+
+          field :kind, String, null: false, description: "email_domain or profile."
+          field :field, String, description: "The profile field a profile condition reads."
+          field :value, String, null: false,
+                description: "The domain a verified email address ends with, or the value the profile field equals. " \
+                             "A profile condition matches only people whose profile a directory sets."
+
+          def kind
+            object["kind"]
+          end
+
+          def field
+            object["field"]
+          end
+
+          def value
+            object["value"]
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/group_member_type.rb

@@ -0,0 +1,16 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class GroupMemberType < BaseObject
+          description "A person's place in a group, and what put them there."
+
+          field :group, GroupType, null: false
+          field :actor, ActorType, null: false
+          field :sourced_by, String, description: "rule, provider, or group when the group's source put them in. Null when a manager added them by hand."
+          field :created_at, GraphQL::Types::ISO8601DateTime, null: false
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/group_type.rb

@@ -3,14 +3,26 @@ module Masks
     module Manage
       module Types
         class GroupType < BaseObject
-          description "A named set of people in the tenant. The groups claim lists the key of each group a person is in."
+          description "A named set of people in the tenant. The groups claim lists the key of each group a person is in. " \
+                      "A group fills by hand, from a rule, from a provider, or from other groups."
 
           field :key, String, null: false
           field :name, String, null: false
+          field :source, String, null: false, description: "manual, rule, provider, or group."
+          field :rule, [ GroupConditionType ], null: false, description: "The conditions a rule group checks. Empty unless the source is rule."
+          field :provider_key, String, description: "The provider a provider group reads at sign-in."
+          field :upstream_group, String, description: "The group name the provider lists for people who belong."
+          field :parent_labels, [ String ], null: false, description: "The group keys and organization roles, as key:role, a nested group holds everyone from."
+          field :refreshed_at, GraphQL::Types::ISO8601DateTime, description: "When the source last filled the group."
           field :member_count, Integer, null: false
           field :members, [ ActorType ], null: false
+          field :memberships, [ GroupMemberType ], null: false, description: "Each member with what put them in the group."
           field :created_at, GraphQL::Types::ISO8601DateTime, null: false
 
+          def provider_key
+            object.provider&.key
+          end
+
           def member_count
             object.members.count
           end
@@ -18,6 +30,10 @@ module Masks
           def members
             object.actors.order(:nickname)
           end
+
+          def memberships
+            object.members.includes(:actor).sort_by { |member| member.actor.nickname.to_s }
+          end
         end
       end
     end

data/app/graphql/masks/server/manage/types/health_check_type.rb

@@ -0,0 +1,18 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class HealthCheckType < BaseObject
+          description "The latest result of one health check. Checks run every 10 minutes."
+
+          field :name, ID, null: false, description: "jobs, worker, queue, ldap, metrics, mail, origin, domains, or keys."
+          field :status, String, null: false, description: "ok, warning, or failing."
+          field :summary, String, null: false, description: "A short word for what the check found, such as none, stale, or silent."
+          field :details, GraphQL::Types::JSON, null: false, description: "The figures and names behind the summary."
+          field :checked_at, GraphQL::Types::ISO8601DateTime, null: false
+          field :changed_at, GraphQL::Types::ISO8601DateTime, null: false, description: "When the status last changed."
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/ldap_credential_type.rb

@@ -7,6 +7,7 @@ module Masks
           field :label, String, null: false
           field :bind_dn, String, null: false, description: "The DN an app binds as, under ou=services in this tenant's directory."
           field :issued_by, ActorType
+          field :client, ClientType, description: "The client whose app passwords bind through this credential, when one was chosen."
           field :used_at, GraphQL::Types::ISO8601DateTime, description: "When an app last bound with it, to within five minutes."
           field :created_at, GraphQL::Types::ISO8601DateTime, null: false
 

data/app/graphql/masks/server/manage/types/mutation_type.rb

@@ -28,6 +28,9 @@ module Masks
           field :delete_group, mutation: Mutations::DeleteGroup
           field :add_group_member, mutation: Mutations::AddGroupMember
           field :remove_group_member, mutation: Mutations::RemoveGroupMember
+          field :grant_access, mutation: Mutations::GrantAccess
+          field :decline_access, mutation: Mutations::DeclineAccess
+          field :refresh_group, mutation: Mutations::RefreshGroup
           field :disable_code_factor, mutation: Mutations::DisableCodeFactor
           field :revoke_passkey, mutation: Mutations::RevokePasskey
           field :upload_avatar, mutation: Mutations::UploadAvatar
@@ -97,6 +100,7 @@ module Masks
           field :activate_signing_key, mutation: Mutations::ActivateSigningKey
           field :discard_signing_key, mutation: Mutations::DiscardSigningKey
           field :rotate_signing_key, mutation: Mutations::RotateSigningKey
+          field :run_health_checks, mutation: Mutations::RunHealthChecks
         end
       end
     end

data/app/graphql/masks/server/manage/types/query_type.rb

@@ -191,6 +191,13 @@ module Masks
 
           field :event_actions, [ EventActionType ], null: false
 
+          field :health, [ HealthCheckType ], null: false,
+                description: "The latest result of each health check for this tenant and the server it runs on. " \
+                             "Empty until the first scheduled run."
+          field :release, ReleaseType,
+                description: "The newest release when it is newer than this server. Null while the server is current, " \
+                             "or while MASKS_RELEASE_CHECK is off."
+
           LIMIT = 50
           CEILING = 200
           SPAN = 30
@@ -464,6 +471,23 @@ module Masks
             Masks::Server::Event::ACTIONS.sort
           end
 
+          def health
+            Masks::Server::HealthCheck.by_name
+          end
+
+          def release
+            found = Masks::Server::Release.available
+
+            return nil if found.nil?
+
+            {
+              version: found["version"],
+              url: found["url"],
+              operator_step: found["operator_step"] == true,
+              checked_at: Time.iso8601(found["checked_at"])
+            }
+          end
+
           private
 
             def actor_scope(search: nil, activated: nil, holds: nil, pending_approval: nil, recovery_requested: nil,

data/app/graphql/masks/server/manage/types/release_type.rb

@@ -0,0 +1,16 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class ReleaseType < BaseObject
+          description "A newer release of masks than the one this server runs."
+
+          field :version, String, null: false
+          field :url, String, null: false, description: "The release notes."
+          field :operator_step, Boolean, null: false, description: "Whether the release notes carry a line that starts with Operator:."
+          field :checked_at, GraphQL::Types::ISO8601DateTime, null: false
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/tenant_type.rb

@@ -9,7 +9,7 @@ module Masks
           field :origins, [ String ], null: false, description: "Every origin this tenant answers on, each its own issuer."
 
           def origins
-            [ object.templated_origin, object.custom_origin ].compact
+            [ object.templated_origin || object.held_origin, object.custom_origin ].compact
           end
           field :name, String, null: false
           field :named_by, String, null: false
@@ -31,6 +31,11 @@ module Masks
           def event_retention_days
             object.event_retention.in_days.round
           end
+          field :invitation_lifetime, Integer, null: false, description: "Seconds an invitation to an account stays valid."
+          field :organization_invitation_lifetime, Integer, null: false,
+                                                            description: "Seconds an invitation to an organization stays open after it was last sent."
+          field :password_reset_lifetime, Integer, null: false, description: "Seconds a password reset link stays valid."
+          field :email_verification_lifetime, Integer, null: false, description: "Seconds an email confirmation link stays valid."
           field :ldap_enabled, Boolean, null: false, description: "Whether the LDAP directory answers for this tenant.", method: :ldap?
           field :ldap_password_only, Boolean, null: false,
                                      description: "Whether a password alone binds to LDAP for an account that would otherwise need a second factor.",

data/app/helpers/masks/server/account_helper.rb

@@ -29,6 +29,10 @@ module Masks
         t("account.index.#{key}", **options)
       end
 
+      def account_access_requests(organization)
+        AccessRequest.for_organization(organization).includes(:actor, :client).order(:created_at)
+      end
+
       def account_roster(organization)
         organization.memberships.sort_by do |member|
           [ member.pending? ? 1 : 0, member.owner? ? 0 : 1, Members.label(member).to_s.downcase ]

data/app/jobs/masks/server/cleanup_job.rb

@@ -34,6 +34,7 @@ module Masks
           Members.purge_lapsed!
           Replay.where(expires_at: ...Time.current).in_batches(of: BATCH).delete_all
           ReleasedNickname.lapsed.in_batches(of: BATCH).delete_all
+          AccessRequest.lapsed.in_batches(of: BATCH).delete_all
         end
 
         def sweep_tokens(cutoff)

data/app/jobs/masks/server/health_check_job.rb

@@ -0,0 +1,21 @@
+module Masks
+  module Server
+    class HealthCheckJob < ApplicationJob
+      queue_as :maintenance
+      across_tenants!
+
+      def perform
+        server = Health.server_results
+        failing = Hash.new { |held, name| held[name] = [] }
+
+        begin
+          each_tenant do |tenant|
+            Health.store!(server + Health.tenant_results).select(&:failing?).each { |row| failing[row.name] << tenant.subdomain }
+          end
+        ensure
+          Health.remember_all!(failing)
+        end
+      end
+    end
+  end
+end

data/app/jobs/masks/server/refresh_groups_job.rb

@@ -0,0 +1,18 @@
+module Masks
+  module Server
+    class RefreshGroupsJob < ApplicationJob
+      queue_as :maintenance
+      across_tenants!
+
+      def perform
+        each_tenant { refresh }
+      end
+
+      private
+
+        def refresh
+          Group.sourced.find_each(&:refresh!)
+        end
+    end
+  end
+end

data/app/jobs/masks/server/release_check_job.rb

@@ -0,0 +1,21 @@
+module Masks
+  module Server
+    class ReleaseCheckJob < ApplicationJob
+      queue_as :maintenance
+      across_tenants!
+
+      def perform
+        return unless ::Rails.configuration.masks.release_check
+
+        found = Release.check!
+
+        return if found.nil?
+
+        each_tenant do
+          Event.record!(Event::RELEASE_AVAILABLE, by: nil, version: found["version"], url: found["url"],
+                                                  operator_step: found["operator_step"])
+        end
+      end
+    end
+  end
+end

data/app/ldap/masks/server/ldap/connection.rb

@@ -58,7 +58,7 @@ module Masks
 
           def bind(message)
             request = message.operation
-            @bound = nil
+            previous, @bound = @bound, nil
 
             if request.version != 3
               return write(Protocol.bind_response(message.id, Protocol::PROTOCOL_ERROR, "only LDAPv3 is spoken here"))
@@ -68,7 +68,8 @@ module Masks
               return write(Protocol.bind_response(message.id, Protocol::AUTH_METHOD_NOT_SUPPORTED, "only simple binds are supported"))
             end
 
-            outcome = Gate.new(ip_address: @ip_address).bind(request.name, request.password)
+            outcome = Gate.new(ip_address: @ip_address, client_id: previous&.service? ? previous.client_id : nil)
+                          .bind(request.name, request.password)
             @bound = outcome.bound
 
             write(Protocol.bind_response(message.id, outcome.code, outcome.message))

data/app/ldap/masks/server/ldap/gate.rb

@@ -5,7 +5,11 @@ module Masks
         WINDOW = 3.minutes
         VIA = "ldap".freeze
 
-        Bound = Data.define(:kind, :tenant, :dn, :subject) do
+        Bound = Data.define(:kind, :tenant, :dn, :subject, :client_id) do
+          def initialize(client_id: nil, **rest)
+            super(client_id: client_id, **rest)
+          end
+
           def service?
             kind == :service
           end
@@ -17,8 +21,9 @@ module Masks
 
         Outcome = Data.define(:code, :message, :bound)
 
-        def initialize(ip_address:)
+        def initialize(ip_address:, client_id: nil)
           @ip_address = ip_address
+          @client_id = client_id
         end
 
         def bind(name, password)
@@ -80,7 +85,8 @@ module Masks
 
             Outcome.new(
               code: Protocol::SUCCESS, message: "",
-              bound: Bound.new(kind: :service, tenant: tenant, dn: directory.service_dn(credential.label), subject: credential.id)
+              bound: Bound.new(kind: :service, tenant: tenant, dn: directory.service_dn(credential.label), subject: credential.id,
+                               client_id: credential.client_id)
             )
           end
 
@@ -93,6 +99,7 @@ module Masks
             end
 
             actor = Actor.authenticate(uid, password)
+            return app_password(tenant, directory, uid, password, account) if actor.nil? && app_password?(password)
 
             if actor.nil?
               failed!(ip_key, account)
@@ -103,8 +110,28 @@ module Masks
             return refuse(uid, reason, actor) if reason
 
             actor.active!
+            bound(tenant, directory, actor)
+          end
+
+          def app_password?(password)
+            @client_id && AppPassword.shaped?(password)
+          end
+
+          def app_password(tenant, directory, uid, password, account)
+            client = Client.active.find_by(id: @client_id)
+            outcome = AppPasswords.authenticate(client: client, identifier: uid, secret: password, via: VIA,
+                                                ip_address: @ip_address, tenant: tenant)
+
+            return throttled if outcome.throttled?
+            return bound(tenant, directory, outcome.actor, factor: AppPasswords::FACTOR) if outcome.actor
+
+            failed!(ip_key, account) if outcome.wrong?
+            invalid
+          end
+
+          def bound(tenant, directory, actor, factor: "password")
             dn = directory.person_dn(actor)
-            Event.record!(Event::LDAP_BOUND, actor: actor, dn: dn.to_s)
+            Event.record!(Event::LDAP_BOUND, actor: actor, dn: dn.to_s, factor: factor)
 
             Outcome.new(code: Protocol::SUCCESS, message: "", bound: Bound.new(kind: :person, tenant: tenant, dn: dn, subject: actor.id))
           end

data/app/logins/masks/server/login_states/second_factor.rb

@@ -11,7 +11,7 @@ module Masks
         end
 
         prompts "second-factor" do
-          login.first_factored? && !login.second_factored?
+          login.first_factored? && !login.second_factored? && !login.relaxed?
         end
 
         def factor!

data/app/mailers/masks/server/actor_mailer.rb

@@ -160,6 +160,37 @@ module Masks
         )
       end
 
+      def access_granted(asked, journey:)
+        return message unless deliverable?
+
+        journey!(journey)
+        @actor = asked.actor
+        @app = asked.client
+        @url = (@app.approved? && @app.client_uri.presence) || home
+
+        mail(
+          from: self.class.from,
+          to: @actor.email,
+          subject: customize!(:access_granted, actor: @actor, app: @app.name,
+                                               default: t("actor_mailer.access_granted.subject", app: @app.name))
+        )
+      end
+
+      def access_declined(asked, journey:)
+        return message unless deliverable?
+
+        journey!(journey)
+        @actor = asked.actor
+        @app = asked.client
+
+        mail(
+          from: self.class.from,
+          to: @actor.email,
+          subject: customize!(:access_declined, actor: @actor, app: @app.name,
+                                                default: t("actor_mailer.access_declined.subject", app: @app.name))
+        )
+      end
+
       private
 
         def tenant_lede(manager)

data/app/models/masks/server/access_request.rb

@@ -0,0 +1,103 @@
+module Masks
+  module Server
+    class AccessRequest < ApplicationRecord
+      include TenantScoped
+
+      class Refused < StandardError; end
+
+      LIFETIME = 30.days
+
+      belongs_to :actor
+      belongs_to :client
+      belongs_to :decided_by, class_name: "Actor", optional: true
+
+      scope :open, -> { where(granted_at: nil, declined_at: nil) }
+      scope :lapsed, -> { where(created_at: ...LIFETIME.ago) }
+      scope :newest_first, -> { order(created_at: :desc) }
+
+      class << self
+        def ask!(actor:, client:)
+          return nil if client.admits?(actor)
+
+          open.find_by(actor: actor, client: client) || begin
+            created = create!(actor: actor, client: client)
+            Event.record!(Event::ACCESS_REQUESTED, actor: actor, client: client)
+            created
+          end
+        rescue ActiveRecord::RecordNotUnique
+          open.find_by!(actor: actor, client: client)
+        end
+
+        def for_organization(organization)
+          open.joins(:client).where("EXISTS (SELECT 1 FROM unnest(clients.allowed_groups) AS held WHERE held LIKE ?)",
+                                   "#{sanitize_sql_like(organization.key)}:%")
+        end
+      end
+
+      def open?
+        granted_at.nil? && declined_at.nil?
+      end
+
+      def grant!(label: nil, by:, journey:)
+        raise Refused, "#{actor.identifier} is already admitted to #{client.name}" if client.admits?(actor)
+        raise Refused, "this request is already decided" unless open?
+
+        chosen = label.presence || client.allowed_groups.first
+        raise Refused, "#{chosen} is not one of the groups #{client.name} allows" unless client.allowed_groups.include?(chosen)
+
+        transaction do
+          admit!(chosen, by: by)
+          update!(granted_at: Time.current, decided_by: by, label: chosen)
+          Event.record!(Event::ACCESS_GRANTED, actor: actor, by: by, client: client, label: chosen)
+        end
+
+        ActorMailer.access_granted(self, journey: journey).deliver_later if actor.email.present?
+
+        self
+      end
+
+      def decline!(by:, journey:)
+        raise Refused, "this request is already decided" unless open?
+
+        transaction do
+          update!(declined_at: Time.current, decided_by: by)
+          Event.record!(Event::ACCESS_DECLINED, actor: actor, by: by, client: client)
+        end
+
+        ActorMailer.access_declined(self, journey: journey).deliver_later if actor.email.present?
+
+        self
+      end
+
+      def organization_roles
+        client.allowed_groups.filter_map do |held|
+          key, role = held.split(":", 2)
+          [ key, role ] if role
+        end
+      end
+
+      private
+
+        def admit!(label, by:)
+          key, role = label.split(":", 2)
+
+          if role.nil?
+            group = Group.find_by(key: key) || raise(Refused, "there is no group keyed #{key}")
+            group.add!(actor, by: by)
+          else
+            organization = Organization.active.find_by(key: key) || raise(Refused, "there is no organization keyed #{key}")
+            held = organization.memberships.find_by(actor: actor)
+            held = held.destroy! && nil if held&.pending?
+
+            if held.nil?
+              Members.enroll!(organization, actor, role: role, by: by)
+            elsif held.role != role
+              Members.assign!(held, role: role, by: by)
+            end
+          end
+        rescue Members::Refused => e
+          raise Refused, e.message
+        end
+    end
+  end
+end

data/app/models/masks/server/actor.rb

@@ -30,6 +30,7 @@ module Masks
       has_many :approvals, class_name: "Client", foreign_key: :approved_by_id, dependent: :nullify
       has_one :avatar, dependent: :destroy
       has_many :group_members, dependent: :delete_all
+      has_many :access_requests, dependent: :delete_all
       has_many :groups, through: :group_members
 
       before_destroy :sign_out_everywhere!, prepend: true
@@ -61,6 +62,7 @@ module Masks
       after_save :release_previous_nickname, if: :saved_change_to_nickname?
       before_save :forget_code_factors_for_new_addresses
       after_update :forget_mailed_links, if: :saved_change_to_email?
+      after_commit :settle_sourced_groups, on: %i[create update], if: -> { saved_changes.keys.intersect?(Group::WATCHED) }
 
       normalizes :nickname, with: ->(value) { value.to_s.strip.presence }
       normalizes :email, with: ->(value) { value.to_s.strip.downcase.presence }
@@ -469,6 +471,10 @@ module Masks
 
       private
 
+        def settle_sourced_groups
+          Group.ruled.find_each { |group| group.settle!(self) }
+        end
+
         def forget_mailed_links
           [ PasswordReset, Invitation, EmailVerification ].each do |kind|
             kind.where(actor_id: id).live.find_each(&:consume!)