masks-server 0.11.0 → 0.12.0

data/app/models/masks/server/app_password.rb

@@ -0,0 +1,91 @@
+module Masks
+  module Server
+    class AppPassword < Token
+      ALPHABET = "abcdefghjkmnpqrstuvwxyz23456789".freeze
+      LENGTH = 24
+      GROUP = 4
+      LIFETIME = 100.years
+      NAME_LIMIT = 64
+      MOST = 20
+      USED_GRAIN = 1.minute
+
+      class Refused < StandardError; end
+
+      scope :newest_first, -> { order(created_at: :desc) }
+
+      class << self
+        def offered(actor)
+          Client.active.where(app_passwords: true).order(:name).select { |client| client.admits?(actor) }
+        end
+
+        def issue!(actor:, client:, name:)
+          label = name.to_s.strip
+
+          raise Refused, "name" if label.empty? || label.length > NAME_LIMIT
+          raise Refused, "app" if client.nil? || offered(actor).none? { |offered| offered.id == client.id }
+          raise Refused, "too_many" if live.where(actor: actor).count >= MOST
+
+          secret = Array.new(LENGTH) { ALPHABET[SecureRandom.random_number(ALPHABET.length)] }.join
+          held = create!(actor: actor, client: client, digest: BCrypt::Password.create(secret, cost: cost),
+                         payload: { "name" => label }, expires_at: LIFETIME.from_now)
+          held.instance_variable_set(:@secret, grouped(secret))
+          held
+        end
+
+        def normalize(secret)
+          secret.to_s.downcase.delete("- ")
+        end
+
+        def shaped?(secret)
+          offered = normalize(secret)
+
+          offered.length == LENGTH && offered.each_char.all? { |char| ALPHABET.include?(char) }
+        end
+
+        def check(actor:, client:, secret:)
+          offered = normalize(secret)
+          return burn(offered) unless actor && client && shaped?(offered)
+
+          found = live.where(actor: actor, client: client).to_a.find { |held| BCrypt::Password.new(held.digest) == offered }
+
+          found || burn(offered)
+        end
+
+        def grouped(secret)
+          secret.scan(/.{1,#{GROUP}}/o).join("-")
+        end
+
+        private
+
+          def cost
+            ActiveModel::SecurePassword.min_cost ? BCrypt::Engine::MIN_COST : BCrypt::Engine.cost
+          end
+
+          def burn(secret)
+            BCrypt::Password.new(Actor.decoy_digest) == secret
+            nil
+          end
+      end
+
+      def name
+        held("name")
+      end
+
+      def used_at
+        held("used_at")&.then { |value| Time.zone.parse(value) }
+      end
+
+      def used!
+        return if used_at && used_at > USED_GRAIN.ago
+
+        now = Time.current
+        today = now.to_date.iso8601
+        first_today = held("used_on") != today
+
+        update_columns(payload: (payload || {}).merge("used_at" => now.iso8601, "used_on" => today))
+
+        Event.record!(Event::APP_PASSWORD_USED, actor: actor, client: client, name: name) if first_today
+      end
+    end
+  end
+end

data/app/models/masks/server/app_passwords.rb

@@ -0,0 +1,82 @@
+module Masks
+  module Server
+    module AppPasswords
+      FACTOR = "app_password".freeze
+      THROTTLED = "throttled".freeze
+      WINDOW = 3.minutes
+      SCOPE = "masks/server/logins".freeze
+
+      Outcome = Data.define(:actor, :refusal) do
+        def throttled?
+          refusal == THROTTLED
+        end
+
+        def wrong?
+          refusal == FACTOR
+        end
+      end
+
+      class << self
+        def authenticate(client:, identifier:, secret:, via:, ip_address: Current.ip_address, tenant: Current.tenant)
+          return refused(nil, identifier, "factor-not-offered", via, client) unless client&.app_passwords? && !client.archived?
+
+          actor = Actor.locate(identifier)
+          keys = [ account_key(tenant, actor, identifier), address_key(tenant, ip_address) ]
+
+          if throttled?(keys)
+            Event.record!(Event::LOGIN_THROTTLED, actor: actor, by: nil, client: client, identifier: identifier, via: via)
+            return Outcome.new(actor: nil, refusal: THROTTLED)
+          end
+
+          held = AppPassword.check(actor: actor, client: client, secret: secret)
+
+          if held.nil?
+            failed!(keys)
+            return refused(actor, identifier, FACTOR, via, client)
+          end
+
+          reason = obstacle(client, actor)
+          return refused(actor, identifier, reason, via, client) if reason
+
+          actor.active!
+          held.used!
+
+          Outcome.new(actor: actor, refusal: nil)
+        end
+
+        private
+
+          def obstacle(client, actor)
+            return "suspended" if actor.suspended?
+            return "pending_approval" if actor.pending_approval_at.present?
+
+            "not_admitted" unless client.admits?(actor)
+          end
+
+          def refused(actor, identifier, factor, via, client)
+            Event.record!(Event::LOGIN_REFUSED, actor: actor, by: nil, client: client, factor: factor, identifier: identifier, via: via)
+
+            Outcome.new(actor: nil, refusal: factor)
+          end
+
+          def account_key(tenant, actor, identifier)
+            [ "rate-limit", SCOPE, "identifier", tenant.id, actor&.id || identifier.to_s.strip.downcase ].join(":")
+          end
+
+          def address_key(tenant, ip_address)
+            [ "rate-limit", SCOPE, tenant.id, ip_address ].join(":")
+          end
+
+          def throttled?(keys)
+            limits = [ ::Rails.configuration.masks.account_attempt_limit, ::Rails.configuration.masks.attempt_limit ]
+
+            keys.zip(limits).any? { |key, limit| ::Rails.cache.read(key).to_i >= limit }
+          end
+
+          def failed!(keys)
+            keys.each { |key| ::Rails.cache.increment(key, 1, expires_in: WINDOW) }
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/client.rb

@@ -54,6 +54,7 @@ module Masks
       has_many :consents, dependent: :destroy
       has_many :delegations, dependent: :destroy
       has_many :saml_participations, dependent: :delete_all
+      has_many :access_requests, dependent: :delete_all
       has_many :namespaces, -> { order(:name) }, dependent: :nullify
       has_many :enrolled, class_name: "Client", foreign_key: :enrolled_by_id, inverse_of: :enrolled_by,
                           dependent: :nullify
@@ -73,6 +74,7 @@ module Masks
       validate :keys_are_usable
       validate :saml_is_described, if: :saml?
       validate :forward_is_described, if: :forward?
+      validate :forward_auth_rules_are_usable
       validate :backchannel_logout_uri_is_usable
       validate :sector_is_derivable
       validate :consent_is_skipped_only_when_approved
@@ -89,6 +91,7 @@ module Masks
 
       normalizes :allowed_groups, with: ->(value) { Array(value).map { |group| group.to_s.strip.downcase }.compact_blank.uniq.sort }
       normalizes :saml_entity_id, :saml_slo_url, with: ->(value) { value.to_s.strip.presence }
+      normalizes :forward_auth_rules, with: ->(value) { ForwardAuthRules.normalize(value) }
       normalizes(*METADATA_URIS, with: ->(value) { value.to_s.strip.presence })
 
       after_commit :refresh_logo!, on: %i[create update], if: :saved_change_to_logo_uri?
@@ -464,6 +467,10 @@ module Masks
         allowed_groups.empty? || actor.group_labels.intersect?(allowed_groups)
       end
 
+      def forward_rules
+        ForwardAuthRules.new(forward_auth_rules)
+      end
+
       def permitted_scopes(requested)
         return scope_list if Scopes.list(requested).empty?
 
@@ -604,6 +611,14 @@ module Masks
           errors.add(:grant_types, "not supported: #{unknown.join(', ')}") if unknown.any?
         end
 
+        def forward_auth_rules_are_usable
+          held = forward_auth_rules
+
+          return errors.add(:base, "forward auth rules apply only to an app behind a proxy") if held.present? && !forward?
+
+          ForwardAuthRules.problems(held).each { |problem| errors.add(:base, problem) }
+        end
+
         def forward_is_described
           errors.add(:grant_types, "are not used by an app behind a proxy") if grant_types.any?
           errors.add(:token_endpoint_auth_method, "is none for an app behind a proxy") unless public?

data/app/models/masks/server/connection.rb

@@ -20,6 +20,8 @@ module Masks
 
       scope :live, -> { where(revoked_at: nil) }
 
+      after_commit :settle_sourced_groups, if: -> { saved_changes.keys.intersect?(%w[upstream_groups revoked_at actor_id]) }
+
       class << self
         def record!(provider:, actor:, identity:)
           subject = identity["sub"].presence ||
@@ -40,6 +42,7 @@ module Masks
       end
 
       def absorb_identity(identity)
+        self.upstream_groups = Array(identity[Provider::GROUPS]).map(&:to_s).compact_blank.uniq
         held = identity["email"].to_s.strip.downcase.presence
 
         return self if held.nil?
@@ -125,6 +128,10 @@ module Masks
 
       private
 
+        def settle_sourced_groups
+          Group.filled_by(provider).find_each { |group| group.settle!(actor) }
+        end
+
         def store_tokens!(tokens, **attributes)
           update!(access_token: tokens["access_token"], access_token_expires_at: expiry_from(tokens),
                   tokens_refreshed_at: Time.current, **attributes)

data/app/models/masks/server/declared.rb

@@ -3,7 +3,8 @@ module Masks
     class Declared
       class Invalid < StandardError; end
 
-      TENANT_KEYS = %w[name accent_color groups apps].freeze
+      TENANT_SETTINGS = (%w[name accent_color] + Tenant::LINK_LIFETIMES.keys.map(&:to_s)).freeze
+      TENANT_KEYS = (TENANT_SETTINGS + %w[groups apps]).freeze
       APP_KEYS = %w[preset url slug name client_id client_secret_env redirect_uris scopes allowed_groups
                     access_token_lifetime refresh_token_lifetime refresh_token_absolute_lifetime].freeze
 
@@ -47,12 +48,19 @@ module Masks
         def apply_tenant(tenant, declared)
           known!(declared, TENANT_KEYS, tenant.subdomain)
 
-          tenant.update!(declared.slice("name", "accent_color").compact) if declared.key?("name") || declared.key?("accent_color")
+          settings = declared.slice(*TENANT_SETTINGS).compact
+          apply_settings(tenant, settings) if settings.any?
 
           Array(declared["groups"]).each { |key, group| apply_group(key, group || {}) }
           Array(declared["apps"]).filter_map { |key, app| apply_app(tenant, key, app || {}) }
         end
 
+        def apply_settings(tenant, settings)
+          tenant.update!(settings)
+        rescue ActiveRecord::RecordInvalid => e
+          raise Invalid, "#{tenant.subdomain}: #{e.record.errors.full_messages.to_sentence}"
+        end
+
         def apply_group(key, declared)
           group = Group.find_or_initialize_by(key: key)
           group.update!(name: declared["name"] || group.name || key.to_s.humanize)

data/app/models/masks/server/email_verification.rb

@@ -5,8 +5,8 @@ module Masks
 
       path "verify"
 
-      def self.lifetime
-        ::Rails.configuration.masks.email_verification_lifetime
+      def self.lifetime(tenant = Current.tenant)
+        Tenant.link_lifetime(:email_verification_lifetime, tenant)
       end
 
       def self.settle!(secret)

data/app/models/masks/server/event.rb

@@ -54,6 +54,10 @@ module Masks
       GROUP_DELETED = "group.deleted".freeze
       GROUP_JOINED = "group.member_added".freeze
       GROUP_LEFT = "group.member_removed".freeze
+      ACCESS_REQUESTED = "access.requested".freeze
+      ACCESS_GRANTED = "access.granted".freeze
+      ACCESS_DECLINED = "access.declined".freeze
+      GROUP_REFRESHED = "group.refreshed".freeze
 
       DEVICE_CODE_ISSUED = "device_code.issued".freeze
       DEVICE_CODE_APPROVED = "device_code.approved".freeze
@@ -98,6 +102,9 @@ module Masks
       LDAP_CREDENTIAL_ISSUED = "ldap_credential.issued".freeze
       LDAP_CREDENTIAL_REVOKED = "ldap_credential.revoked".freeze
       LDAP_BOUND = "ldap.bound".freeze
+      APP_PASSWORD_CREATED = "app_password.created".freeze
+      APP_PASSWORD_USED = "app_password.used".freeze
+      APP_PASSWORD_REVOKED = "app_password.revoked".freeze
 
       CLIENT_CREATED = "client.created".freeze
       CLIENT_REGISTERED = "client.registered".freeze
@@ -169,12 +176,15 @@ module Masks
       CUSTOM_DOMAIN_STOPPED = "custom_domain.stopped".freeze
 
       JOB_FAILED = "job.failed".freeze
+      HEALTH_FAILING = "health.failing".freeze
+      HEALTH_RECOVERED = "health.recovered".freeze
+      RELEASE_AVAILABLE = "release.available".freeze
 
       GRAVE = [
         LOGIN_REFUSED, LOGIN_THROTTLED, LOGOUT_UNDELIVERED, REFRESH_REUSED, STREAM_FAILED,
         DEVICE_BLOCKED, ACTOR_DELETED, AUTHENTICATOR_DISABLED, CONNECTION_REFUSED, DELEGATION_REFUSED,
         EXCHANGE_REFUSED, SIGN_IN_RISKY, SIGNAL_UNDELIVERED, TEXT_UNDELIVERED, SIGNAL_RECEIVED, MEMBERSHIP_ROLE_KEPT,
-        ORGANIZATION_OWNERLESS, JOB_FAILED
+        ORGANIZATION_OWNERLESS, JOB_FAILED, HEALTH_FAILING
       ].freeze
 
       ACTIONS = constants(false).filter_map do |name|

data/app/models/masks/server/federation/protocol.rb

@@ -86,7 +86,7 @@ module Masks
             end
 
             held["sub"] = dig(raw, map["sub"])&.to_s.presence
-            held[Provider::GROUPS] = Array(groups(raw)).map(&:to_s).presence if provider.organization_id
+            held[Provider::GROUPS] = Array(groups(raw)).map(&:to_s).presence
             held.compact
           end
 

data/app/models/masks/server/federation/saml.rb

@@ -104,7 +104,7 @@ module Masks
 
             held["sub"] = map["sub"] == NAME_ID ? response.name_id.to_s.presence : attribute(attributes, map["sub"])&.to_s.presence
             held["email"] = held["email"].to_s.strip.downcase.presence
-            held[Provider::GROUPS] = Array(attributes.multi(provider.group_claim)).map(&:to_s).presence if provider.organization_id
+            held[Provider::GROUPS] = Array(attributes.multi(provider.group_claim)).map(&:to_s).presence
 
             held.compact
           end

data/app/models/masks/server/forward_auth_rules.rb

@@ -0,0 +1,162 @@
+module Masks
+  module Server
+    class ForwardAuthRules
+      OPEN = "open".freeze
+      ONE_FACTOR = "one_factor".freeze
+      TWO_FACTOR = "two_factor".freeze
+      TOKEN = "token".freeze
+      DENY = "deny".freeze
+      OUTCOMES = [ OPEN, ONE_FACTOR, TWO_FACTOR, TOKEN, DENY ].freeze
+
+      SIGN_IN = "sign_in".freeze
+      DEFAULT = "default".freeze
+
+      METHODS = %w[GET HEAD POST PUT PATCH DELETE OPTIONS].freeze
+      LISTS = %w[paths methods networks groups].freeze
+      FIELDS = (LISTS + [ "outcome" ]).freeze
+      MOST_RULES = 50
+      MOST_ENTRIES = 20
+      PATH = %r{\A/[^\s?#]{0,511}\z}
+
+      Decision = Struct.new(:outcome, :rule, :index)
+
+      class Rule
+        attr_reader :paths, :methods, :networks, :groups, :outcome
+
+        def initialize(held)
+          @paths = Array(held["paths"])
+          @methods = Array(held["methods"])
+          @networks = Array(held["networks"]).filter_map { |range| ForwardAuthRules.network(range) }
+          @groups = Array(held["groups"])
+          @outcome = held["outcome"].to_s
+        end
+
+        def covers?(path, method, address)
+          covers_path?(path) && covers_method?(method) && covers_address?(address)
+        end
+
+        def gated?
+          groups.any?
+        end
+
+        def admits?(actor)
+          !gated? || actor.group_labels.intersect?(groups)
+        end
+
+        private
+
+          def covers_path?(path)
+            paths.empty? || patterns.any? { |pattern| pattern.match?(path) }
+          end
+
+          def covers_method?(method)
+            methods.empty? || methods.include?(method)
+          end
+
+          def covers_address?(address)
+            return true if networks.empty?
+
+            held = ForwardAuthRules.address(address)
+            held.present? && networks.any? { |network| network.include?(held) }
+          end
+
+          def patterns
+            @patterns ||= paths.map { |path| ForwardAuthRules.pattern(path) }
+          end
+      end
+
+      class << self
+        def normalize(value)
+          Array(value).map do |held|
+            next held unless held.is_a?(Hash)
+
+            held = held.to_h.transform_keys(&:to_s)
+            lists = LISTS.to_h { |list| [ list, Array(held[list]).map { |entry| entry.to_s.strip }.compact_blank.uniq ] }
+            lists["methods"] = lists["methods"].map(&:upcase)
+            lists["groups"] = lists["groups"].map(&:downcase)
+
+            held.except(*FIELDS).merge(lists, "outcome" => held["outcome"].to_s.strip.downcase)
+          end
+        end
+
+        def problems(rules)
+          return [ "forward auth rules must be a list of rules" ] unless rules.is_a?(Array)
+          return [ "forward auth rules hold more than #{MOST_RULES} rules" ] if rules.size > MOST_RULES
+
+          rules.flat_map.with_index(1) { |rule, position| problems_in(rule, position) }
+        end
+
+        def pattern(path)
+          source = path.split("**", -1).map { |piece| piece.split("*", -1).map { |held| Regexp.escape(held) }.join("[^/]*") }.join(".*")
+          source = "#{source.delete_suffix('/.*')}(/.*)?" if path.end_with?("/**")
+
+          /\A#{source}\z/
+        end
+
+        def network(range)
+          IPAddr.new(range.to_s)
+        rescue IPAddr::Error
+          nil
+        end
+
+        def address(value)
+          held = IPAddr.new(value.to_s.split("%").first.to_s)
+          held.ipv4_mapped? ? held.native : held
+        rescue IPAddr::Error
+          nil
+        end
+
+        def path(value)
+          decoded = URI::RFC2396_PARSER.unescape(value.to_s)
+          cleaned = Pathname.new(decoded.start_with?("/") ? decoded : "/#{decoded}").cleanpath.to_s
+
+          cleaned.start_with?("/") ? cleaned : "/"
+        end
+
+        private
+
+          def problems_in(rule, position)
+            named = "forward auth rule #{position}"
+            return [ "#{named} is not a set of fields" ] unless rule.is_a?(Hash)
+
+            unknown = rule.keys - FIELDS
+            return [ "#{named} names #{unknown.join(', ')}, which is not a field" ] if unknown.any?
+
+            [
+              ("#{named} has an outcome of #{rule['outcome'].inspect}, which is not one of #{OUTCOMES.join(', ')}" unless OUTCOMES.include?(rule["outcome"])),
+              *LISTS.map { |list| ("#{named} lists more than #{MOST_ENTRIES} #{list}" if rule[list].size > MOST_ENTRIES) },
+              *rule["paths"].grep_v(PATH).map { |path| "#{named} has a path of #{path.inspect}, which does not start with /" },
+              *(rule["methods"] - METHODS).map { |method| "#{named} names a method of #{method.inspect}, which is not one of #{METHODS.join(', ')}" },
+              *rule["networks"].reject { |range| network(range) }.map { |range| "#{named} has a network of #{range.inspect}, which is not an address or a range such as 192.168.0.0/16" },
+              *rule["groups"].grep_v(Client::ALLOWED_GROUP).map { |group| "#{named} names a group of #{group.inspect}, which is not a group key or key:role" }
+            ].compact
+          end
+      end
+
+      attr_reader :rules
+
+      def initialize(held)
+        @rules = Array(held).select { |rule| rule.is_a?(Hash) }.map { |rule| Rule.new(rule) }
+      end
+
+      def any?
+        rules.any?
+      end
+
+      def decide(path:, method:, address:, actor: nil)
+        cleaned = self.class.path(path)
+        verb = method.to_s.upcase.presence || "GET"
+
+        rules.each_with_index do |rule, index|
+          next unless rule.covers?(cleaned, verb, address)
+          return Decision.new(SIGN_IN, rule, index) if rule.gated? && actor.nil?
+          next unless rule.admits?(actor)
+
+          return Decision.new(rule.outcome, rule, index)
+        end
+
+        Decision.new(DEFAULT, nil, nil)
+      end
+    end
+  end
+end