masks-server 0.11.0 → 0.13.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 608910b5ec386933423f04a3596c4b5d454b38e956449ca66d762d2cd79e3e82
-  data.tar.gz: f70b574939800fdcb3407025402e39663e15f8a9c71e2dff473685147e7cf693
+  metadata.gz: c268c36afc7aa404d7cb904ef65cb1f67db51d6b84bdb3a5f83d5aae7d84bf48
+  data.tar.gz: '09285b0606e241c323c82f16555328830421c7d97338d9aa32f38055e6972353'
 SHA512:
-  metadata.gz: a061d6d81ac514d825d3963c466e99272d224e0250e964e8a057a8e794a7cd1f26955cd8e1cb5753eb418f8c91e5dd2d9b31b98c8bba4eb97d11d7112ce0a40b
-  data.tar.gz: c537d6afb5fc139d5e83fd92143f0eb28588f9ec1992e607209f89c5c9f59dfff3502dc0f1196a39c2a19fcec67910458494324a70e739ced310ea73f69168cb
+  metadata.gz: a253ac4a9e52258b001f1a7424a189728979a5363255d1d9c4d306e70385ea2eecdd8f93e2859603f6959e43786f90be43921d5ed7bc523fa81477f06384f507
+  data.tar.gz: 844b3eb9927070dfddbea67dbbb17992772e84348c35ffdc9feba33fd1b079f718e9d986b8f9da591f77498a54a8404c7240a6dd5ad22d320a04500ec57641f6

data/app/controllers/concerns/masks/server/scim_endpoint.rb

@@ -8,9 +8,9 @@ module Masks
 
         skip_forgery_protection
 
-        rate_limit to: 600, within: 1.minute,
+        rate_limit **Throttle.limits(:scim),
                    by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                   with: -> { scim_error(Scim::Error.new(:too_many_requests, "too many provisioning requests from this address")) }
+                   with: Throttle.refused(:scim) { scim_error(Scim::Error.new(:too_many_requests, "too many provisioning requests from this address")) }
 
         rescue_from Scim::Error, with: :scim_error
         before_action :require_provisioner

data/app/controllers/masks/server/account_controller.rb

@@ -9,6 +9,9 @@ module Masks
         return redirect_to login_path if @actor.nil?
 
         @apps = Apps.held_by(@actor)
+        @app_passwords = AppPassword.live.where(actor: @actor).includes(:client).newest_first.to_a
+        @app_password_clients = AppPassword.offered(@actor)
+        @app_password = flash[:app_password]
         @launchable = Apps.launchable(@actor)
         @invitations = @actor.memberships.outstanding.joins(:organization).merge(Organization.active)
                              .includes(:organization, :invited_by).order("organizations.name").to_a

data/app/controllers/masks/server/account_exports_controller.rb

@@ -1,9 +1,9 @@
 module Masks
   module Server
     class AccountExportsController < ApplicationController
-      rate_limit to: 5, within: 1.hour, only: :create,
+      rate_limit **Throttle.limits(:export), only: :create,
                  by: -> { [ current_tenant.id, current_actor&.id || request.remote_ip ].join(":") },
-                 with: -> { redirect_to root_path(anchor: "export"), alert: t("account_export.throttled") }
+                 with: Throttle.refused(:export) { redirect_to root_path(anchor: "export"), alert: t("account_export.throttled") }
 
       def create
         actor = current_actor

data/app/controllers/masks/server/addresses_controller.rb

@@ -1,10 +1,9 @@
 module Masks
   module Server
     class AddressesController < ApplicationController
-      rate_limit to: ::Rails.configuration.masks.account_attempt_limit,
-                 within: 3.minutes,
+      rate_limit **Throttle.limits(:account_attempt),
                  by: -> { [ current_tenant.id, current_actor&.id ].join(":") },
-                 with: -> { refuse(t("addresses.too_many_attempts")) },
+                 with: Throttle.refused(:account_attempt) { refuse(t("addresses.too_many_attempts")) },
                  only: :update
 
       before_action :require_actor

data/app/controllers/masks/server/app_passwords_controller.rb

@@ -0,0 +1,41 @@
+module Masks
+  module Server
+    class AppPasswordsController < ApplicationController
+      ANCHOR = "app-passwords".freeze
+
+      before_action :require_actor
+
+      def create
+        return unless reauthenticated!(ANCHOR, t("app_passwords.again"))
+
+        client = Client.active.find_by(client_id: params[:client_id].to_s)
+        held = AppPassword.issue!(actor: current_actor, client: client, name: params[:name])
+
+        Event.record!(Event::APP_PASSWORD_CREATED, actor: current_actor, client: client, name: held.name)
+
+        flash[:app_password] = { "name" => held.name, "app" => client.name, "secret" => held.secret }
+        redirect_to root_path(anchor: ANCHOR)
+      rescue AppPassword::Refused => e
+        redirect_to root_path(anchor: ANCHOR), alert: t("app_passwords.refused.#{e.message}", most: AppPassword::MOST)
+      end
+
+      def destroy
+        held = AppPassword.live.find_by(id: params[:id].to_s[/\A\d+\z/], actor: current_actor)
+
+        return redirect_to root_path(anchor: ANCHOR), alert: t("app_passwords.unknown") if held.nil?
+
+        held.revoke!
+
+        Event.record!(Event::APP_PASSWORD_REVOKED, actor: current_actor, client: held.client, name: held.name)
+
+        redirect_to root_path(anchor: ANCHOR), notice: t("app_passwords.revoked", name: held.name)
+      end
+
+      private
+
+        def require_actor
+          redirect_to login_path unless current_actor
+        end
+    end
+  end
+end

data/app/controllers/masks/server/authenticator_apps_controller.rb

@@ -1,10 +1,9 @@
 module Masks
   module Server
     class AuthenticatorAppsController < ApplicationController
-      rate_limit to: ::Rails.configuration.masks.account_attempt_limit,
-                 within: 3.minutes,
+      rate_limit **Throttle.limits(:account_attempt),
                  by: -> { [ current_tenant.id, current_actor&.id ].join(":") },
-                 with: -> { refuse(t("authenticator_apps.too_many_attempts")) },
+                 with: Throttle.refused(:account_attempt) { refuse(t("authenticator_apps.too_many_attempts")) },
                  only: :create
 
       before_action :require_actor

data/app/controllers/masks/server/authorize_controller.rb

@@ -9,6 +9,10 @@ module Masks
         refuse(bad_request(:invalid_request_object, refusal.message))
       end
 
+      rate_limit **Throttle.limits(:access_request), only: :ask,
+                 by: -> { [ current_tenant.id, current_actor&.id, refused_request(params[:rid])&.client_id ].join(":") },
+                 with: Throttle.refused(:access_request) { redirect_to authorize_refused_path(rid: params[:rid]), alert: t("authorize.error.slow_down") }
+
       def show
         authorization = Authorization.from_request(request)
 
@@ -45,7 +49,7 @@ module Masks
 
         login = advance(pending)
 
-        return redirect_to(refuse_on_masks(pending, login.refusal)) if login.refused? && !answerable?(pending)
+        return redirect_to(refuse_on_masks(pending, login.refusal)) if login.refused? && (!answerable?(pending) || askable?(pending, login))
         return answer(deny(pending, login.refusal.error, login.refusal.description)) if login.refused?
         return interaction_required(pending) if login.prompted? && pending.silent?
         return redirect_to(login.redirect_to, allow_other_host: true) if login.redirect_to.present?
@@ -55,14 +59,31 @@ module Masks
       end
 
       def refused
-        refusal = refused_request(params[:rid])&.refusal
+        pending = refused_request(params[:rid])
+        refusal = pending&.refusal
 
         return show_error("invalid_request", "that sign-in request has expired", :bad_request) if refusal.nil?
 
         @refused = true
+        @asking = asking_for(pending)
+        @waiting = @asking && AccessRequest.open.find_by(actor: current_actor, client: @asking)
+        @return_to = answerable?(pending) && pending.authorization.redirect_with(
+          issuer: issuer, error: refusal["error"], error_description: refusal["description"]
+        )
         show_error(refusal["error"], refusal["description"], :forbidden)
       end
 
+      def ask
+        pending = refused_request(params[:rid])
+        asking = pending && asking_for(pending)
+
+        return show_error("invalid_request", "that sign-in request has expired", :bad_request) if asking.nil?
+
+        AccessRequest.ask!(actor: current_actor, client: asking)
+
+        redirect_to authorize_refused_path(rid: params[:rid]), notice: t("authorize.error.asked")
+      end
+
       private
 
         def validate(authorization)
@@ -149,6 +170,16 @@ module Masks
           end
         end
 
+        def askable?(pending, login)
+          !pending.silent? && login.actor.present? && asking_for(pending, login.actor).present?
+        end
+
+        def asking_for(pending, actor = current_actor)
+          client = pending.client
+
+          client if actor && client && client.allowed_groups.any? && !client.admits?(actor)
+        end
+
         def admitted?(authorization)
           tracked(REQUESTS).key?(authorization.fingerprint)
         end

data/app/controllers/masks/server/device_authorizations_controller.rb

@@ -4,9 +4,9 @@ module Masks
       include RackOAuth2Endpoint
       include TokenPresented
 
-      rate_limit to: 60, within: 1.minute,
+      rate_limit **Throttle.limits(:device_authorization),
                  by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                 with: -> { slow_down }
+                 with: Throttle.refused(:device_authorization) { slow_down }
 
       def create
         client = authenticate_client!

data/app/controllers/masks/server/device_verifications_controller.rb

@@ -6,10 +6,10 @@ module Masks
 
       before_action :establish_device
 
-      rate_limit to: ::Rails.configuration.masks.device_code_limit, within: 3.minutes,
+      rate_limit **Throttle.limits(:device_code),
                  if: -> { params[:user_code].present? },
                  by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                 with: -> { asking(UNKNOWN, status: :too_many_requests) }
+                 with: Throttle.refused(:device_code) { asking(UNKNOWN, status: :too_many_requests) }
 
       def show
         return asking(params[:refused].presence) if params[:user_code].blank?

data/app/controllers/masks/server/enrollments_controller.rb

@@ -3,18 +3,18 @@ module Masks
     class EnrollmentsController < ApplicationController
       include TokenPresented
 
-      rate_limit to: 30, within: 1.minute,
+      rate_limit **Throttle.limits(:enrollment),
                  by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                 with: -> {
+                 with: Throttle.refused(:enrollment) {
                    render json: {
                      "error" => "too_many_requests",
                      "error_description" => "too many enrollment tokens asked for from this address"
                    }, status: :too_many_requests
                  }
 
-      rate_limit to: 60, within: 1.hour, only: :create, name: "app",
+      rate_limit **Throttle.limits(:app_enrollment), only: :create, name: "app",
                  by: -> { [ current_tenant.id, claimed_client_id ].join(":") },
-                 with: -> {
+                 with: Throttle.refused(:app_enrollment) {
                    render json: {
                      "error" => "too_many_requests",
                      "error_description" => "too many enrollment tokens asked for by this app"

data/app/controllers/masks/server/forward_auth_controller.rb

@@ -4,9 +4,9 @@ module Masks
       skip_forgery_protection
       before_action -> { request.session_options[:skip] = true }, only: %i[check callback]
 
-      rate_limit to: 30, within: 1.minute, only: %i[start callback],
+      rate_limit **Throttle.limits(:forward_auth), only: %i[start callback],
                  by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                 with: -> { head :too_many_requests }
+                 with: Throttle.refused(:forward_auth) { head :too_many_requests }
 
       def check
         target = Forwarded.target(request)
@@ -15,13 +15,21 @@ module Masks
 
         client = Client.forwarding_to(target)
         return head(:forbidden) if client.nil?
+        return basic(client, target) if ActionController::HttpAuthentication::Basic.has_basic_credentials?(request)
 
         held = ForwardSession.held(cookies[ForwardSession::COOKIE], client)
-        return admit(held.actor) if held
-
-        return head(:unauthorized) if params[:status] == "401"
-
-        redirect_to forward_auth_start_url(rd: target.to_s), allow_other_host: true
+        decided = client.forward_rules.decide(path: target.path, method: forwarded_method, address: request.remote_ip,
+                                              actor: held&.actor)
+
+        case decided.outcome
+        when ForwardAuthRules::OPEN then admit(held&.actor)
+        when ForwardAuthRules::DENY then head(:forbidden)
+        when ForwardAuthRules::ONE_FACTOR then held ? admit(held.actor) : ask_to_sign_in(target)
+        when ForwardAuthRules::TWO_FACTOR then held&.session&.multi_factored? ? admit(held.actor) : ask_to_sign_in(target)
+        else
+          complete = held if held&.session&.complete?
+          decided.outcome == ForwardAuthRules::TOKEN ? admit_presented(client, complete) : answer(complete, target)
+        end
       end
 
       def start
@@ -29,8 +37,20 @@ module Masks
         client = Client.forwarding_to(target)
 
         return render(plain: t("forward_auth.unknown"), status: :not_found) if client.nil?
-        return redirect_to(login_path(return_to: request.fullpath)) if current_actor.nil?
-        return render(plain: t("forward_auth.not_admitted", app: client.name), status: :forbidden) unless client.admits?(current_actor)
+
+        decided = client.forward_rules.decide(path: target.path, method: "GET", address: request.remote_ip, actor: current_actor)
+
+        return render(plain: t("forward_auth.denied", app: client.name), status: :forbidden) if decided.outcome == ForwardAuthRules::DENY
+        return send_to_login(decided) if current_actor.nil?
+
+        unless client.admits?(current_actor)
+          return redirect_to(target.to_s, allow_other_host: true) if decided.outcome == ForwardAuthRules::OPEN
+
+          return render(plain: t("forward_auth.not_admitted", app: client.name), status: :forbidden)
+        end
+
+        return step_up if decided.outcome == ForwardAuthRules::TWO_FACTOR && !current_session.multi_factored?
+        return step_up if [ ForwardAuthRules::ONE_FACTOR, ForwardAuthRules::OPEN ].exclude?(decided.outcome) && !current_session.complete?
 
         code = ForwardCode.mint!(actor: current_actor, client: client, session: current_session,
                                  payload: { "return_to" => target.to_s })
@@ -67,15 +87,87 @@ module Masks
           redirect_to code.return_to, allow_other_host: true
         end
 
-        def admit(actor)
-          response.headers["Remote-User"] = actor.nickname.presence || actor.identifier
-          response.headers["Remote-Email"] = actor.email if actor.email_verified_at.present?
-          response.headers["Remote-Name"] = actor.name if actor.name.present?
-          response.headers["Remote-Groups"] = actor.group_labels.join(",")
+        def basic(client, target)
+          identifier, secret = ActionController::HttpAuthentication::Basic.user_name_and_password(request)
+          outcome = AppPasswords.authenticate(client: client, identifier: identifier, secret: secret, via: "forward_auth")
+
+          return head(:too_many_requests) if outcome.throttled?
+          return head(:unauthorized) if outcome.actor.nil?
+
+          decided = client.forward_rules.decide(path: target.path, method: forwarded_method, address: request.remote_ip,
+                                                actor: outcome.actor)
+          return head(:forbidden) if decided.outcome == ForwardAuthRules::DENY
+
+          admit(outcome.actor)
+        end
+
+        def answer(held, target)
+          held ? admit(held.actor) : ask_to_sign_in(target)
+        end
+
+        def ask_to_sign_in(target)
+          return head(:unauthorized) if params[:status] == "401"
+
+          redirect_to forward_auth_start_url(rd: target.to_s), allow_other_host: true
+        end
+
+        def send_to_login(decided)
+          Login.new(store: login_store).relax! if decided.outcome == ForwardAuthRules::ONE_FACTOR
+
+          redirect_to login_path(return_to: request.fullpath)
+        end
+
+        def step_up
+          Login.new(store: login_store).step_up!
+
+          redirect_to login_path(return_to: request.fullpath)
+        end
+
+        def admit_presented(client, held)
+          return admit(held.actor) if held
+
+          token = presented_token(client)
+          return admit(token.actor, machine: token.client) if token
+
+          response.headers["WWW-Authenticate"] = %(Bearer realm="#{client.forward_origin}")
+          head :unauthorized
+        end
+
+        def presented_token(client)
+          scheme, secret = request.authorization.to_s.split(" ", 2)
+          return nil unless scheme.to_s.casecmp?("Bearer") && secret.present?
+
+          claims = AccessToken.decode(secret.strip, issuer: issuer)
+          token = AccessToken.live.includes(:actor, :client).find_by(digest: claims["jti"])
+
+          return nil if token.nil? || token.bound? || token.client.nil?
+          return nil unless token.client_id == client.id || Array(token.audience).include?(client.forward_origin)
+          return nil if token.actor && (token.actor.suspended? || !client.admits?(token.actor))
+
+          token
+        rescue JWT::DecodeError
+          nil
+        end
+
+        def admit(actor, machine: nil)
+          if actor
+            response.headers["Remote-User"] = actor.nickname.presence || actor.identifier
+            response.headers["Remote-Email"] = actor.email if actor.email_verified_at.present?
+            response.headers["Remote-Name"] = actor.name if actor.name.present?
+            response.headers["Remote-Groups"] = actor.group_labels.join(",")
+          elsif machine
+            response.headers["Remote-User"] = machine.client_id
+            response.headers["Remote-Name"] = machine.name
+            response.headers["Remote-Groups"] = ""
+          end
 
           head :ok
         end
 
+        def forwarded_method
+          request.headers["X-Forwarded-Method"].presence || request.headers["X-Original-Method"].presence || "GET"
+        end
+
         def return_to
           raw = request.query_string[/(?:\A|&)rd=(.*)\z/m, 1].to_s
 

data/app/controllers/masks/server/introspections_controller.rb

@@ -5,9 +5,9 @@ module Masks
 
       INACTIVE = { "active" => false }.freeze
 
-      rate_limit to: 120, within: 1.minute,
+      rate_limit **Throttle.limits(:introspection),
                  by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                 with: -> { render json: INACTIVE, status: :too_many_requests }
+                 with: Throttle.refused(:introspection) { render json: INACTIVE, status: :too_many_requests }
 
       def create
         client = authenticate_client!

data/app/controllers/masks/server/logins_controller.rb

@@ -8,26 +8,22 @@ module Masks
 
       skip_forgery_protection
 
-      rate_limit to: ::Rails.configuration.masks.attempt_limit,
-                 within: 3.minutes, only: :update, if: -> { verifying? },
+      rate_limit **Throttle.limits(:attempt), only: :update, if: -> { verifying? },
                  by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                 with: -> { too_many("too-many-attempts") }
+                 with: Throttle.refused(:attempt) { too_many("too-many-attempts") }
 
-      rate_limit to: ::Rails.configuration.masks.account_attempt_limit,
-                 within: 3.minutes, only: :update, name: "identifier", if: -> { verifying? },
+      rate_limit **Throttle.limits(:account_attempt), only: :update, name: "identifier", if: -> { verifying? },
                  by: -> { [ current_tenant.id, attempted_account ].join(":") },
-                 with: -> { too_many("too-many-attempts-for-account") }
+                 with: Throttle.refused(:account_attempt) { too_many("too-many-attempts-for-account") }
 
-      rate_limit to: ::Rails.configuration.masks.recovery_limit,
-                 within: 15.minutes, only: :update, name: "recovery",
+      rate_limit **Throttle.limits(:recovery), only: :update, name: "recovery",
                  if: -> { Login.limit_for(params[:event]) == :sending },
                  by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                 with: -> { too_many("too-many-attempts") }
+                 with: Throttle.refused(:recovery) { too_many("too-many-attempts") }
 
-      rate_limit to: ::Rails.configuration.masks.attempt_limit,
-                 within: 3.minutes, only: %i[provider posted_provider], name: "provider",
+      rate_limit **Throttle.limits(:attempt), only: %i[provider posted_provider], name: "provider",
                  by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                 with: -> { too_many("too-many-attempts") }
+                 with: Throttle.refused(:attempt) { too_many("too-many-attempts") }
 
       before_action :refuse_blocked_agent
       before_action :verify_authenticity_token, except: :posted_provider
@@ -35,9 +31,9 @@ module Masks
 
       def show
         hold_return_to
-        return redirect_to after_login_path if current_actor && pending.nil?
-
         @login = run
+        return redirect_to after_login_path if current_actor && pending.nil? && !@login.stepping_up?
+
         @login.carry!(flash[:warnings]) if flash[:warnings].present?
 
         redirect_to after_login_path if @login.settled?
@@ -108,6 +104,8 @@ module Masks
         end
 
         def take_posted(handle)
+          return {} unless Replay.first?("provider-callback", handle, expires_in: POSTED_WINDOW)
+
           key = posted_key(handle)
           held = ::Rails.cache.read(key)
           ::Rails.cache.delete(key)
@@ -153,8 +151,9 @@ module Masks
           if login.touched?(:first_factor)
             sign_in(login.actor, amr: login.amr, policy: login.policy, first_factor: login.first_factored_by,
                                  authenticated_at: login.authenticated_at)
+            current_session.update!(second_factor_skipped: true) if login.skipped_second_factor?
           elsif login.signed_in? && login.touched?(:second_factor)
-            current_session.update!(amr: Array(current_session.amr) | login.amr)
+            current_session.update!(amr: Array(current_session.amr) | login.amr, second_factor_skipped: false)
           end
 
           forget_login

data/app/controllers/masks/server/organization_access_controller.rb

@@ -0,0 +1,39 @@
+module Masks
+  module Server
+    class OrganizationAccessController < OrganizationMembersController
+      def create
+        own!
+
+        asked = asked!
+        role = params[:role].to_s
+
+        asked.grant!(label: "#{@organization.key}:#{role}", by: current_actor, journey: Journey.account(current_actor))
+
+        back(notice: t("organization_access.granted", identifier: asked.actor.identifier, app: asked.client.name,
+                                                      role: role, organization: @organization.name))
+      rescue AccessRequest::Refused => e
+        back(alert: e.message)
+      end
+
+      def destroy
+        own!
+
+        asked = asked!
+        asked.decline!(by: current_actor, journey: Journey.account(current_actor))
+
+        back(notice: t("organization_access.declined", identifier: asked.actor.identifier, app: asked.client.name))
+      rescue AccessRequest::Refused => e
+        back(alert: e.message)
+      end
+
+      private
+
+        def asked!
+          id = params[:id].to_s[/\A\d+\z/]
+
+          (id && AccessRequest.for_organization(@organization).includes(:actor, :client).find_by(id: id)) ||
+            raise(AccessRequest::Refused, t("organization_access.unknown", organization: @organization.name))
+        end
+    end
+  end
+end

data/app/controllers/masks/server/organization_members_controller.rb

@@ -7,9 +7,9 @@ module Masks
         back(alert: t("organization_members.owners_only", organization: @organization.name))
       end
 
-      rate_limit to: 30, within: 1.minute, only: %i[create resend],
+      rate_limit **Throttle.limits(:invitation), only: %i[create resend],
                  by: -> { [ current_tenant.id, current_actor&.id || request.remote_ip ].join(":") },
-                 with: -> { back(alert: t("organization_members.slow_down")) }
+                 with: Throttle.refused(:invitation) { back(alert: t("organization_members.slow_down")) }
 
       before_action :require_actor
       before_action :require_membership

data/app/controllers/masks/server/passwords_controller.rb

@@ -1,10 +1,9 @@
 module Masks
   module Server
     class PasswordsController < ApplicationController
-      rate_limit to: ::Rails.configuration.masks.account_attempt_limit,
-                 within: 3.minutes,
+      rate_limit **Throttle.limits(:account_attempt),
                  by: -> { [ current_tenant.id, current_actor&.id ].join(":") },
-                 with: -> { refuse(t("passwords.too_many_attempts")) }
+                 with: Throttle.refused(:account_attempt) { refuse(t("passwords.too_many_attempts")) }
 
       before_action :require_actor
 

data/app/controllers/masks/server/pushed_authorizations_controller.rb

@@ -3,9 +3,9 @@ module Masks
     class PushedAuthorizationsController < ApplicationController
       include TokenPresented
 
-      rate_limit to: 60, within: 1.minute,
+      rate_limit **Throttle.limits(:pushed_authorization),
                  by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                 with: -> { slow_down }
+                 with: Throttle.refused(:pushed_authorization) { slow_down }
 
       def create
         client = authenticate_client!

data/app/controllers/masks/server/received_signals_controller.rb

@@ -3,9 +3,9 @@ module Masks
     class ReceivedSignalsController < ApplicationController
       skip_forgery_protection
 
-      rate_limit to: 600, within: 1.minute, only: :create,
+      rate_limit **Throttle.limits(:signal), only: :create,
                  by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                 with: -> { render json: { "err" => "invalid_request", "description" => "too many events from this address" }, status: :too_many_requests }
+                 with: Throttle.refused(:signal) { render json: { "err" => "invalid_request", "description" => "too many events from this address" }, status: :too_many_requests }
 
       def create
         ReceivedSignal.new(request.raw_post, issuer: issuer).receive!

data/app/controllers/masks/server/registrations_controller.rb

@@ -3,9 +3,9 @@ module Masks
     class RegistrationsController < ApplicationController
       skip_forgery_protection
 
-      rate_limit to: ::Rails.configuration.masks.registration_limit, within: 10.minutes, only: :create,
+      rate_limit **Throttle.limits(:registration), only: :create,
                  by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                 with: -> {
+                 with: Throttle.refused(:registration) {
                    render json: {
                      "error" => "too_many_requests",
                      "error_description" => "too many registrations from this address"

data/app/controllers/masks/server/revocations_controller.rb

@@ -3,9 +3,9 @@ module Masks
     class RevocationsController < ApplicationController
       include TokenPresented
 
-      rate_limit to: 120, within: 1.minute,
+      rate_limit **Throttle.limits(:revocation),
                  by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                 with: -> {
+                 with: Throttle.refused(:revocation) {
                    render json: {
                      "error" => "slow_down",
                      "error_description" => "too many revocation requests from this address"

data/app/controllers/masks/server/saml_controller.rb

@@ -5,9 +5,9 @@ module Masks
 
       skip_forgery_protection only: %i[sso slo]
 
-      rate_limit to: 60, within: 1.minute, only: %i[sso initiate slo],
+      rate_limit **Throttle.limits(:saml), only: %i[sso initiate slo],
                  by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                 with: -> { refuse("too many sign-in requests from this address", status: :too_many_requests) }
+                 with: Throttle.refused(:saml) { refuse("too many sign-in requests from this address", status: :too_many_requests) }
 
       rescue_from SamlIdentity::Refused do |refusal|
         refuse(refusal.message)

data/app/controllers/masks/server/sign_in_approvals_controller.rb

@@ -5,11 +5,10 @@ module Masks
 
       before_action :require_trusted_device
 
-      rate_limit to: ::Rails.configuration.masks.account_attempt_limit,
-                 within: 3.minutes,
+      rate_limit **Throttle.limits(:account_attempt),
                  only: :create,
                  by: -> { [ current_tenant.id, current_actor&.id ].join(":") },
-                 with: -> { refuse(t("sign_in_approvals.too_many_attempts")) }
+                 with: Throttle.refused(:account_attempt) { refuse(t("sign_in_approvals.too_many_attempts")) }
 
       def create
         approval = SignInApproval.matching(actor: current_actor, code: params[:code], from: current_device)

data/app/controllers/masks/server/tokens_controller.rb

@@ -9,9 +9,9 @@ module Masks
 
       skip_forgery_protection
 
-      rate_limit to: 60, within: 1.minute,
+      rate_limit **Throttle.limits(:token),
                  by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
-                 with: -> { slow_down }
+                 with: Throttle.refused(:token) { slow_down }
 
       def create
         return unsupported_grant_type unless Client::GRANT_TYPES.include?(params[:grant_type].to_s)