masks-server 0.11.0 → 0.12.0

data/app/models/masks/server/group.rb

@@ -3,29 +3,232 @@ module Masks
     class Group < ApplicationRecord
       include TenantScoped
 
+      class Sourced < StandardError; end
+
       KEY = /\A[a-z0-9][a-z0-9._-]*\z/
+      MANUAL = "manual".freeze
+      RULE = "rule".freeze
+      PROVIDER = "provider".freeze
+      NESTED = "group".freeze
+      SOURCES = [ MANUAL, RULE, PROVIDER, NESTED ].freeze
+      SOURCED = [ RULE, PROVIDER, NESTED ].freeze
+      SETTINGS = %w[source rule provider_id upstream_group parent_labels].freeze
+      WATCHED = (%w[email email_verified_at] + GroupRule::FIELDS).freeze
+      PARENTS = 10
+      LONGEST = 200
 
+      belongs_to :provider, optional: true
       has_many :members, class_name: "GroupMember", dependent: :delete_all
       has_many :actors, through: :members
 
+      scope :sourced, -> { where(source: SOURCED) }
+      scope :ruled, -> { where(source: RULE) }
+      scope :filled_by, ->(provider) { where(source: PROVIDER, provider_id: provider.id) }
+      scope :nested_under, ->(label) { where(source: NESTED).where("groups.parent_labels @> ?", [ label ].to_json) }
+      scope :nested_under_organization, lambda { |key|
+        where(source: NESTED).where(
+          "EXISTS (SELECT 1 FROM jsonb_array_elements_text(groups.parent_labels) AS label WHERE label LIKE ?)",
+          "#{sanitize_sql_like(key)}:%"
+        )
+      }
+
       normalizes :key, with: ->(value) { value.to_s.strip.downcase }
       normalizes :name, with: ->(value) { value.to_s.strip }
+      normalizes :source, with: ->(value) { value.to_s.strip.downcase.presence || MANUAL }
+      normalizes :rule, with: ->(value) { GroupRule.normalize(value) }
+      normalizes :upstream_group, with: ->(value) { value.to_s.strip.presence }
+      normalizes :parent_labels, with: ->(value) { Array(value).map { |label| label.to_s.strip.downcase }.compact_blank.uniq.sort }
 
       validates :key, presence: true, format: { with: KEY }, length: { maximum: 64 },
                       uniqueness: { scope: :tenant_id }
       validates :name, presence: true, length: { maximum: 100 }
+      validates :source, inclusion: { in: SOURCES }
+      validate :source_is_complete
+
+      after_commit :refresh_after_change, on: %i[create update], if: -> { saved_changes.keys.intersect?(SETTINGS) }
+      after_commit :refresh_children, on: :destroy
+
+      def sourced?
+        SOURCED.include?(source)
+      end
+
+      def children
+        Group.nested_under(key)
+      end
 
       def add!(actor, by: nil)
         member = members.find_or_create_by!(actor: actor)
-        Event.record!(Event::GROUP_JOINED, actor: actor, by: by, group: key) if member.previously_new_record?
+
+        if member.previously_new_record?
+          Event.record!(Event::GROUP_JOINED, actor: actor, by: by, group: key)
+          settle_children!(actor, by: by)
+        elsif member.sourced?
+          member.update!(sourced_by: nil)
+          Event.record!(Event::GROUP_JOINED, actor: actor, by: by, group: key, kept: true)
+        end
+
         member
       end
 
       def remove!(actor, by: nil)
-        removed = members.where(actor: actor).delete_all.positive?
-        Event.record!(Event::GROUP_LEFT, actor: actor, by: by, group: key) if removed
-        removed
+        member = members.find_by(actor: actor)
+
+        return false if member.nil?
+        raise Sourced, "#{actor.identifier} is in #{name} from its #{source}, so the #{source} decides" if member.sourced?
+
+        member.delete
+        Event.record!(Event::GROUP_LEFT, actor: actor, by: by, group: key)
+        settle_children!(actor, by: by)
+
+        true
       end
+
+      def refresh!(by: nil, seen: Set.new)
+        return self unless seen.add?(id)
+
+        wanted = sourced? ? wanted_actor_ids : []
+        held = members.where(sourced_by: source).pluck(:actor_id)
+        pinned = members.manual.pluck(:actor_id)
+        joining = wanted - held - pinned
+        leaving = (held - wanted) | members.sourced.where.not(sourced_by: source).pluck(:actor_id)
+
+        transaction do
+          members.sourced.where(actor_id: leaving).delete_all if leaving.any?
+          members.insert_all(joining.map { |actor_id| { actor_id: actor_id, tenant_id: tenant_id, sourced_by: source } }) if joining.any?
+          update_column(:refreshed_at, Time.current)
+        end
+
+        return self if joining.empty? && leaving.empty?
+
+        Event.record!(Event::GROUP_REFRESHED, by: by, group: key, source: source, added: joining.size, removed: leaving.size)
+        children.find_each { |child| child.refresh!(by: by, seen: seen) }
+
+        self
+      end
+
+      def settle!(actor, by: nil, seen: Set.new)
+        return unless seen.add?(id)
+
+        member = members.find_by(actor: actor)
+
+        return if member && !member.sourced?
+
+        if sourced? && wants?(actor)
+          return if member&.sourced_by == source
+
+          member ? member.update!(sourced_by: source) : members.create!(actor: actor, sourced_by: source)
+          Event.record!(Event::GROUP_JOINED, actor: actor, by: by, group: key, source: source) if member.nil?
+        elsif member
+          member.delete
+          Event.record!(Event::GROUP_LEFT, actor: actor, by: by, group: key, source: member.sourced_by)
+        else
+          return
+        end
+
+        children.find_each { |child| child.settle!(actor, by: by, seen: seen) }
+      end
+
+      def wants?(actor)
+        case source
+        when RULE then GroupRule.scope(rule).exists?(id: actor.id)
+        when PROVIDER then provider_connections.exists?(actor_id: actor.id)
+        when NESTED then parent_members.exists?(actor_id: actor.id) || parent_memberships.exists?(actor_id: actor.id)
+        else false
+        end
+      end
+
+      def parent_keys
+        parent_labels.grep_v(/:/)
+      end
+
+      private
+
+        def wanted_actor_ids
+          case source
+          when RULE then GroupRule.scope(rule).pluck(:id)
+          when PROVIDER then provider_connections.distinct.pluck(:actor_id)
+          when NESTED then parent_members.distinct.pluck(:actor_id) | parent_memberships.distinct.pluck(:actor_id)
+          else []
+          end
+        end
+
+        def provider_connections
+          return Connection.none if provider_id.nil?
+
+          Connection.live.where(provider_id: provider_id).where("connections.upstream_groups @> ?", [ upstream_group ].to_json)
+        end
+
+        def parent_members
+          GroupMember.joins(:group).where(groups: { key: parent_keys })
+        end
+
+        def parent_memberships
+          roles = parent_labels.grep(/:/).map { |label| label.split(":", 2) }
+
+          return Membership.none if roles.empty?
+
+          held = roles.map do |key, role|
+            Membership.sanitize_sql_array([ "(organizations.key = ? AND memberships.role = ?)", key, role ])
+          end
+
+          Membership.accepted.joins(:organization).merge(Organization.active).where(held.join(" OR "))
+        end
+
+        def settle_children!(actor, by:)
+          children.find_each { |child| child.settle!(actor, by: by) }
+        end
+
+        def refresh_after_change
+          refresh!
+        end
+
+        def refresh_children
+          children.find_each(&:refresh!)
+        end
+
+        def source_is_complete
+          case source
+          when RULE then GroupRule.problems(rule).each { |problem| errors.add(:rule, problem) }
+          when PROVIDER then provider_is_complete
+          when NESTED then parents_are_complete
+          end
+        end
+
+        def provider_is_complete
+          errors.add(:provider, "is needed to fill a group from one") if provider.nil?
+          errors.add(:upstream_group, "names the group at the provider") if upstream_group.blank? || upstream_group.length > LONGEST
+        end
+
+        def parents_are_complete
+          return errors.add(:parent_labels, "name at least one group or organization role") if parent_labels.empty?
+          return errors.add(:parent_labels, "name at most #{PARENTS}") if parent_labels.size > PARENTS
+
+          parent_labels.grep_v(Client::ALLOWED_GROUP).each do |label|
+            errors.add(:parent_labels, "has #{label}, which is not a group key or key:role")
+          end
+
+          (parent_keys - Group.where(key: parent_keys).pluck(:key)).each do |missing|
+            errors.add(:parent_labels, "name #{missing}, which is not a group")
+          end
+
+          errors.add(:parent_labels, "would put #{name} inside itself") if cycles?
+        end
+
+        def cycles?
+          pending = parent_keys.dup
+          seen = Set.new
+
+          until pending.empty?
+            held = pending.shift
+
+            return true if held == key
+            next unless seen.add?(held)
+
+            pending.concat(Array(Group.where(key: held, source: NESTED).pick(:parent_labels)).grep_v(/:/))
+          end
+
+          false
+        end
     end
   end
 end

data/app/models/masks/server/group_member.rb

@@ -5,6 +5,13 @@ module Masks
 
       belongs_to :group
       belongs_to :actor
+
+      scope :manual, -> { where(sourced_by: nil) }
+      scope :sourced, -> { where.not(sourced_by: nil) }
+
+      def sourced?
+        sourced_by.present?
+      end
     end
   end
 end

data/app/models/masks/server/group_rule.rb

@@ -0,0 +1,63 @@
+module Masks
+  module Server
+    module GroupRule
+      EMAIL_DOMAIN = "email_domain".freeze
+      PROFILE = "profile".freeze
+      KINDS = [ EMAIL_DOMAIN, PROFILE ].freeze
+      FIELDS = %w[name given_name family_name middle_name nickname gender zoneinfo locale].freeze
+      LIMIT = 5
+      DOMAIN = /\A[a-z0-9][a-z0-9.-]*\.[a-z]{2,}\z/
+      LONGEST = 200
+
+      class << self
+        def normalize(value)
+          Array(value).filter_map do |condition|
+            next unless condition.respond_to?(:to_h)
+
+            held = condition.to_h.to_h { |key, item| [ key.to_s, item.to_s.strip ] }
+            kind = held["kind"]
+            value = kind == EMAIL_DOMAIN ? held["value"].to_s.downcase.delete_prefix("@") : held["value"].to_s
+
+            { "kind" => kind, "field" => (held["field"] if kind == PROFILE), "value" => value }.compact
+          end
+        end
+
+        def problems(conditions)
+          return [ "a rule has at most #{LIMIT} conditions" ] if conditions.size > LIMIT
+          return [ "a rule needs at least one condition" ] if conditions.empty?
+
+          conditions.filter_map { |condition| problem(condition) }
+        end
+
+        def scope(conditions)
+          conditions.reduce(Actor.all) do |scope, condition|
+            case condition["kind"]
+            when EMAIL_DOMAIN
+              scope.where.not(email_verified_at: nil)
+                   .where("LOWER(actors.email) LIKE ?", "%@#{Actor.sanitize_sql_like(condition['value'])}")
+            when PROFILE
+              scope.merge(Actor.directed).where(condition["field"] => condition["value"])
+            else
+              scope.none
+            end
+          end
+        end
+
+        private
+
+          def problem(condition)
+            case condition["kind"]
+            when EMAIL_DOMAIN
+              "#{condition['value'].inspect} is not a domain" unless condition["value"].match?(DOMAIN)
+            when PROFILE
+              return "#{condition['field'].inspect} is not a profile field a rule can read" unless FIELDS.include?(condition["field"])
+
+              "a profile condition needs a value" if condition["value"].blank? || condition["value"].length > LONGEST
+            else
+              "#{condition['kind'].inspect} is not a kind of condition"
+            end
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/health.rb

@@ -0,0 +1,243 @@
+require "net/smtp"
+
+module Masks
+  module Server
+    module Health
+      Result = Struct.new(:name, :status, :summary, :details) do
+        def failing?
+          status == HealthCheck::FAILING
+        end
+      end
+
+      SERVER = %w[jobs worker queue ldap metrics].freeze
+      TENANT = %w[mail origin domains keys].freeze
+      NAMES = (SERVER + TENANT).freeze
+
+      FAILING_KEY = "masks:health:failing".freeze
+      ORIGIN_PREFIX = "masks:health:origin:".freeze
+      KEEP = 1.day
+      NOTE_EVERY = 10.minutes
+      SMTP_TIMEOUT = 5
+      TOKEN_LENGTH = 24
+
+      SMTP_ERRORS = [
+        Net::SMTPError, IOError, SystemCallError, SocketError, Timeout::Error, OpenSSL::SSL::SSLError
+      ].freeze
+
+      module_function
+
+      def check!(tenant = Current.tenant)
+        rows = store!(server_results + tenant_results)
+        remember!(tenant, rows)
+        rows
+      end
+
+      def server_results
+        [ jobs_result, worker_result, queue_result, ldap_result, metrics_result ]
+      end
+
+      def tenant_results
+        [ mail_result, origin_result, domains_result, keys_result ]
+      end
+
+      def store!(results)
+        now = Time.current
+
+        results.map do |result|
+          row = HealthCheck.find_or_initialize_by(name: result.name)
+          was = row.status
+
+          row.assign_attributes(status: result.status, summary: result.summary, details: result.details, checked_at: now)
+          row.changed_at = now if was != result.status
+          row.save!
+
+          announce(row, was)
+
+          row
+        end
+      end
+
+      def announce(row, was)
+        if row.failing? && was != HealthCheck::FAILING
+          Event.record!(Event::HEALTH_FAILING, by: nil, check: row.name, summary: row.summary)
+        elsif row.ok? && was == HealthCheck::FAILING
+          Event.record!(Event::HEALTH_RECOVERED, by: nil, check: row.name, summary: row.summary)
+        end
+      end
+
+      def remember!(tenant, rows)
+        held = (::Rails.cache.read(FAILING_KEY) || {}).transform_values { |subdomains| subdomains - [ tenant.subdomain ] }
+        rows.select(&:failing?).each { |row| (held[row.name] ||= []) << tenant.subdomain }
+
+        remember_all!(held)
+      end
+
+      def remember_all!(failing)
+        ::Rails.cache.write(FAILING_KEY, failing.reject { |_, subdomains| subdomains.empty? }, expires_in: KEEP)
+      end
+
+      def failing_named
+        (::Rails.cache.read(FAILING_KEY) || {}).sort.map do |name, subdomains|
+          SERVER.include?(name) ? name : "#{name} (#{subdomains.sort.join(', ')})"
+        end
+      end
+
+      def jobs_result
+        return ok("jobs", "elsewhere") unless Queue.run?
+
+        failed = Queue.failing_jobs
+
+        return ok("jobs", "none") if failed.empty?
+
+        failing("jobs", "failed", count: failed.size, jobs: failed.map(&:demodulize))
+      end
+
+      def worker_result
+        return ok("worker", "elsewhere") unless Queue.run?
+        return ok("worker", "unchecked") unless Queue.silence.positive?
+        return failing("worker", "silent", minutes: Queue.silence.to_i / 60) if Queue.worker_silent?
+
+        ok("worker", "reporting")
+      end
+
+      def queue_result
+        return ok("queue", "elsewhere") unless Queue.run?
+        return ok("queue", "unchecked") unless Queue.wait.positive?
+
+        stuck = Queue.stuck_since
+
+        return failing("queue", "stuck", since: stuck.utc.iso8601, minutes: Queue.wait.to_i / 60) if stuck
+
+        ok("queue", "moving")
+      end
+
+      def ldap_result
+        settings = ::Rails.configuration.masks
+
+        return ok("ldap", "tls") if settings.ldap_cert.present?
+        return ok("ldap", "local") unless settings.ldap_plaintext
+
+        warning("ldap", "plain", port: settings.ldap_port)
+      end
+
+      def metrics_result
+        token = ENV["MASKS_METRICS_TOKEN"]
+
+        return ok("metrics", "off") if token.blank?
+        return warning("metrics", "short", length: token.length, needed: TOKEN_LENGTH) if token.length < TOKEN_LENGTH
+
+        ok("metrics", "on")
+      end
+
+      def mail_result
+        settings = smtp_settings
+
+        return ok("mail", "none") if settings.nil?
+
+        return failing("mail", "silent", error: Senders::Smtp::UNREACHABLE) if settings.delete(:vetted) && !public_smtp?(settings)
+
+        error = smtp_problem(settings)
+
+        error ? failing("mail", "silent", error: error) : ok("mail", "answers")
+      end
+
+      def smtp_settings
+        sender = Sender.primary(Sender::MAIL)
+
+        if sender.is_a?(Senders::Smtp)
+          { address: sender[:address], port: sender[:port].to_i, tls: sender[:tls] == true, domain: sender[:domain], vetted: true }
+        elsif (held = ::Rails.configuration.masks.smtp_settings)
+          { address: held[:address], port: held[:port].to_i, tls: held[:tls] == true, domain: held[:domain] }
+        end
+      end
+
+      def public_smtp?(settings)
+        ::Rails.env.local? || Outbound.public_address(settings[:address], settings[:port]).present?
+      end
+
+      def smtp_problem(settings)
+        smtp = Net::SMTP.new(settings[:address], settings[:port])
+        smtp.open_timeout = SMTP_TIMEOUT
+        smtp.read_timeout = SMTP_TIMEOUT
+        settings[:tls] ? smtp.enable_tls : smtp.enable_starttls_auto
+
+        smtp.start(settings[:domain].presence || "localhost") { nil }
+
+        nil
+      rescue *SMTP_ERRORS => error
+        error.class.name
+      end
+
+      def origin_result
+        return ok("origin", "unset") if Current.tenant&.public_origin.nil?
+
+        noted = ::Rails.cache.read(origin_key(Current.tenant))
+
+        return ok("origin", "matches") if noted.nil?
+
+        warning("origin", "mismatch", seen: noted["seen"], origin: noted["origin"])
+      end
+
+      def note_origin!(tenant, seen, origin)
+        return if seen.nil? || origin.nil? || seen.casecmp?(origin)
+
+        now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        last = noted[tenant.id]
+
+        return if last && now - last < NOTE_EVERY
+
+        noted[tenant.id] = now
+        ::Rails.cache.write(origin_key(tenant), { "seen" => seen, "origin" => origin }, expires_in: KEEP)
+      end
+
+      def forget_origin!(tenant)
+        noted.delete(tenant.id)
+        ::Rails.cache.delete(origin_key(tenant))
+      end
+
+      def noted
+        @noted ||= Concurrent::Map.new
+      end
+
+      def origin_key(tenant)
+        "#{ORIGIN_PREFIX}#{tenant.id}"
+      end
+
+      def domains_result
+        return ok("domains", "none") unless DomainClaim.exists?
+
+        missing = DomainClaim.where.not(missing_since: nil).order(:domain).pluck(:domain)
+
+        return ok("domains", "proven") if missing.empty?
+
+        warning("domains", "missing", domains: missing)
+      end
+
+      def keys_result
+        active = SigningKey.active.first
+
+        return failing("keys", "missing") if active.nil?
+
+        days = ((Time.current - active.activated_at) / 1.day).floor
+        period = Current.tenant.key_rotation_days
+
+        return ok("keys", "manual", days: days) if period.nil?
+        return warning("keys", "stale", days: days, period: period) if days > period
+
+        ok("keys", "fresh", days: days, period: period)
+      end
+
+      def ok(name, summary, **details)
+        Result.new(name, HealthCheck::OK, summary, details.stringify_keys)
+      end
+
+      def warning(name, summary, **details)
+        Result.new(name, HealthCheck::WARNING, summary, details.stringify_keys)
+      end
+
+      def failing(name, summary, **details)
+        Result.new(name, HealthCheck::FAILING, summary, details.stringify_keys)
+      end
+    end
+  end
+end

data/app/models/masks/server/health_check.rb

@@ -0,0 +1,27 @@
+module Masks
+  module Server
+    class HealthCheck < ApplicationRecord
+      include TenantScoped
+
+      OK = "ok".freeze
+      WARNING = "warning".freeze
+      FAILING = "failing".freeze
+      STATUSES = [ OK, WARNING, FAILING ].freeze
+
+      validates :name, presence: true, uniqueness: { scope: :tenant_id }
+      validates :status, inclusion: { in: STATUSES }
+      validates :summary, presence: true
+
+      scope :failing, -> { where(status: FAILING) }
+      scope :by_name, -> { order(:name) }
+
+      def ok?
+        status == OK
+      end
+
+      def failing?
+        status == FAILING
+      end
+    end
+  end
+end

data/app/models/masks/server/invitation.rb

@@ -7,8 +7,8 @@ module Masks
 
       path "invite"
 
-      def self.lifetime
-        ::Rails.configuration.masks.invitation_lifetime
+      def self.lifetime(tenant = Current.tenant)
+        Tenant.link_lifetime(:invitation_lifetime, tenant)
       end
 
       def self.open!(actor:, by: nil)

data/app/models/masks/server/ldap_credential.rb

@@ -7,12 +7,12 @@ module Masks
       class Refused < StandardError; end
 
       class << self
-        def issue!(label:, by:)
+        def issue!(label:, by:, client: nil)
           name = label.to_s.strip.downcase
           raise Refused, "a label is lowercase letters, digits, dots, dashes, and underscores" unless name.match?(LABEL)
           raise Refused, "a live LDAP credential is already labeled #{name}" if named(name)
 
-          mint!(payload: { "label" => name, "issued_by" => by&.uuid }.compact, expires_at: LIFETIME.from_now)
+          mint!(client: client, payload: { "label" => name, "issued_by" => by&.uuid }.compact, expires_at: LIFETIME.from_now)
         end
 
         def named(label)

data/app/models/masks/server/login.rb

@@ -30,6 +30,9 @@ module Masks
 
       SETTLED = "settled".freeze
       FIRST_FACTOR_BY = "first_factor_by".freeze
+      RELAXED = "relaxed".freeze
+      STEP_UP = "step_up".freeze
+      ASKED_FOR = 10.minutes
 
       def self.permitted_updates
         STATES.flat_map { |state| state.declared_updates }.uniq
@@ -256,7 +259,30 @@ module Masks
 
         wanted = request.respond_to?(:multi_factor?) && request.multi_factor?
 
-        wanted || (request.present? && policy.apps_require_second_factor) || state("risk-check").stepping_up?
+        wanted || (request.present? && policy.apps_require_second_factor) || state("risk-check").stepping_up? ||
+          asked?(STEP_UP)
+      end
+
+      def relaxed?
+        asked?(RELAXED) && !stepping_up? && !policy.second_factor_required
+      end
+
+      def skipped_second_factor?
+        relaxed? && actor.present? && actor.second_factor? && !touched?(:second_factor) && !amr.include?(Issuer::MULTI_FACTOR)
+      end
+
+      def relax!(now = Time.current)
+        store[RELAXED] = { "until" => (now + ASKED_FOR).to_i }
+      end
+
+      def step_up!(now = Time.current)
+        store[STEP_UP] = { "until" => (now + ASKED_FOR).to_i }
+      end
+
+      def asked?(key)
+        held = store[key]
+
+        held.is_a?(Hash) && held["until"].to_i > Time.current.to_i
       end
 
       def multi_factored?
@@ -268,7 +294,7 @@ module Masks
       def second_factored?
         return false if reauthenticating? || stale? || actor.nil? || stepping_up?
 
-        touched?(:second_factor) || signed_in? || remembered?(:second_factor)
+        touched?(:second_factor) || (signed_in? && !session.second_factor_skipped?) || remembered?(:second_factor)
       end
 
       def second_factor_pending?

data/app/models/masks/server/mail_previews.rb

@@ -29,6 +29,7 @@ module Masks
             acme = Organization.new(key: "acme", name: "Acme", roles: [ "billing" ])
             joining = Membership.new(organization: acme, actor: person, role: "billing", invited_by: manager,
                                      invited_as: person.email, pending: true)
+            asked = AccessRequest.new(actor: person, client: client || Client.new(name: "Grafana"), label: "admins")
             promoted = Event.new(action: Event::MEMBERSHIP_ROLE_CHANGED, actor: person, by: manager, organization: acme,
                                  created_at: Time.current, details: { "was" => "member", "now" => "owner" })
 
@@ -51,6 +52,10 @@ module Masks
                 ActorMailer.organization_invitation(joining, journey: managing) ],
               [ "approved", "Account approved", managing,
                 ActorMailer.approved(person, journey: managing) ],
+              [ "access_granted", "Access granted", managing,
+                ActorMailer.access_granted(asked, journey: managing) ],
+              [ "access_declined", "Access declined", managing,
+                ActorMailer.access_declined(asked, journey: managing) ],
               [ "notification", "Security notice", system,
                 ActorMailer.notification(person, changed, journey: system) ],
               [ "notification_organization", "Organization role changed", system,

data/app/models/masks/server/mail_template.rb

@@ -13,6 +13,8 @@ module Masks
         "approval_requested" => %w[tenant nickname],
         "recovery_requested" => %w[tenant nickname],
         "approved" => %w[tenant name nickname],
+        "access_granted" => %w[tenant name nickname app],
+        "access_declined" => %w[tenant name nickname app],
         SIGNATURE => %w[tenant]
       }.freeze
       SUBJECT_LIMIT = 150