masks-server 0.11.0 → 0.13.0

data/app/controllers/masks/server/verifications_controller.rb

@@ -1,10 +1,9 @@
 module Masks
   module Server
     class VerificationsController < ApplicationController
-      rate_limit to: ::Rails.configuration.masks.recovery_limit,
-                 within: 15.minutes,
+      rate_limit **Throttle.limits(:recovery),
                  by: -> { [ current_tenant.id, current_actor&.id ].join(":") },
-                 with: -> { redirect_to root_path, alert: t("verifications.too_many_requests") }
+                 with: Throttle.refused(:recovery) { redirect_to root_path, alert: t("verifications.too_many_requests") }
 
       before_action :require_actor
 

data/app/graphql/masks/server/manage/mutations/base_mutation.rb

@@ -102,6 +102,13 @@ module Masks
               Masks::Server::Group.find_by(key: key) || refuse!("no group keyed #{key}")
             end
 
+            def access_request!(id)
+              held = id.to_s[/\A\d+\z/] && Masks::Server::AccessRequest.open.find_by(id: id)
+
+              managed!(held.actor) && held if held
+              held || refuse!("no access request with that id is waiting")
+            end
+
             def invited!(actor)
               actor_created!(actor, invited: true)
 

data/app/graphql/masks/server/manage/mutations/create_group.rb

@@ -3,6 +3,8 @@ module Masks
     module Manage
       module Mutations
         class CreateGroup < BaseMutation
+          include GroupSource
+
           requires :security
 
           argument :key, String, description: "Lowercase letters, digits, dots, dashes, and underscores. Apps see it in the groups claim."
@@ -10,13 +12,13 @@ module Masks
 
           field :group, Types::GroupType, null: false
 
-          def resolve(key:, name:)
-            group = Masks::Server::Group.new(key: key, name: name)
+          def resolve(key:, name:, **source)
+            group = fill_source(Masks::Server::Group.new(key: key, name: name), **source)
             save!(group)
 
-            audit!(Masks::Server::Event::GROUP_CREATED, group: group.key)
+            audit!(Masks::Server::Event::GROUP_CREATED, group: group.key, source: group.source)
 
-            { group: group }
+            { group: group.reload }
           end
         end
       end

data/app/graphql/masks/server/manage/mutations/decline_access.rb

@@ -0,0 +1,27 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class DeclineAccess < BaseMutation
+          requires :security
+
+          description "Declines a waiting access request. The actor is told by email and can ask again in an hour."
+
+          argument :id, ID
+
+          field :access_request, Types::AccessRequestType, null: false
+
+          def resolve(id:)
+            asked = access_request!(id)
+
+            asked.decline!(by: viewer, journey: Masks::Server::Journey.manage(viewer))
+
+            { access_request: asked }
+          rescue Masks::Server::AccessRequest::Refused => e
+            refuse!(e.message)
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/grant_access.rb

@@ -0,0 +1,29 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class GrantAccess < BaseMutation
+          requires :security
+
+          description "Grants a waiting access request by putting the actor in one of the groups the client allows. " \
+                      "Name the group with label, or leave it out for the first one the client allows."
+
+          argument :id, ID
+          argument :label, String, required: false
+
+          field :access_request, Types::AccessRequestType, null: false
+
+          def resolve(id:, label: nil)
+            asked = access_request!(id)
+
+            asked.grant!(label: label, by: viewer, journey: Masks::Server::Journey.manage(viewer))
+
+            { access_request: asked }
+          rescue Masks::Server::AccessRequest::Refused => e
+            refuse!(e.message)
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/group_source.rb

@@ -0,0 +1,34 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        module GroupSource
+          extend ActiveSupport::Concern
+
+          included do
+            argument :source, String, required: false,
+                     description: "manual, rule, provider, or group. A sourced group fills itself and keeps anyone added by hand."
+            argument :rule, [ Types::GroupConditionInput ], required: false,
+                     description: "For rule: up to five conditions, all of which must hold."
+            argument :provider_key, String, required: false, description: "For provider: the provider whose sign-ins list groups."
+            argument :upstream_group, String, required: false, description: "For provider: the group name the provider lists."
+            argument :parent_labels, [ String ], required: false,
+                     description: "For group: group keys and organization roles, as key:role, the group holds everyone from."
+          end
+
+          private
+
+            def fill_source(group, source: nil, rule: nil, provider_key: nil, upstream_group: nil, parent_labels: nil)
+              group.source = source unless source.nil?
+              group.rule = rule.map(&:to_h) unless rule.nil?
+              group.provider = provider_key.blank? ? nil : provider!(provider_key) unless provider_key.nil?
+              group.upstream_group = upstream_group unless upstream_group.nil?
+              group.parent_labels = parent_labels unless parent_labels.nil?
+
+              group
+            end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/issue_ldap_credential.rb

@@ -8,12 +8,15 @@ module Masks
           description "Issues a bind DN and secret an app uses to search this tenant's LDAP directory. The secret is returned once."
 
           argument :label, String, description: "Lowercase letters, digits, dots, dashes, and underscores. It becomes the cn of the bind DN."
+          argument :client_id, ID, required: false,
+                   description: "The client this app is registered as. People who make an app password for that client can bind with it on a connection that bound with this credential first."
 
           field :ldap_credential, Types::LdapCredentialType, null: false
           field :secret, String, null: false
 
-          def resolve(label:)
-            credential = Masks::Server::LdapCredential.issue!(label: label, by: viewer)
+          def resolve(label:, client_id: nil)
+            client = client_id.present? ? client!(client_id) : nil
+            credential = Masks::Server::LdapCredential.issue!(label: label, by: viewer, client: client)
 
             audit!(Masks::Server::Event::LDAP_CREDENTIAL_ISSUED, label: credential.label)
 

data/app/graphql/masks/server/manage/mutations/refresh_group.rb

@@ -0,0 +1,21 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class RefreshGroup < BaseMutation
+          requires :security
+
+          description "Fills a sourced group now instead of waiting for the hourly run."
+
+          argument :key, String
+
+          field :group, Types::GroupType, null: false
+
+          def resolve(key:)
+            { group: group!(key).refresh!(by: viewer) }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/remove_group_member.rb

@@ -17,6 +17,8 @@ module Masks
             group.remove!(actor, by: viewer)
 
             { group: group }
+          rescue Masks::Server::Group::Sourced => e
+            refuse!(e.message)
           end
         end
       end

data/app/graphql/masks/server/manage/mutations/run_health_checks.rb

@@ -0,0 +1,19 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class RunHealthChecks < BaseMutation
+          requires :support
+
+          description "Runs every health check now, instead of waiting for the next scheduled run."
+
+          field :health, [ Types::HealthCheckType ], null: false
+
+          def resolve
+            { health: Masks::Server::Health.check!.sort_by(&:name) }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/update_client.rb

@@ -32,6 +32,8 @@ module Masks
           argument :saml_slo_url, String, required: false,
                    description: "The application's single logout URL, which receives masks' logout messages over HTTP-POST. Empty stops single logout."
           argument :consent_required, Boolean, required: false
+          argument :app_passwords, Boolean, required: false,
+                   description: "Whether people may make an app password for this client. An app password signs in over LDAP and forward auth without a second factor, for this client alone."
           argument :access_token_lifetime, Integer, required: false,
                    description: "Seconds an access token lasts, from 60 to a day. Zero goes back to an hour."
           argument :refresh_token_lifetime, Integer, required: false,
@@ -41,6 +43,10 @@ module Masks
                                 "from 300 to 400 days. Zero goes back to 90 days."
           argument :allowed_groups, [ String ], required: false,
                    description: "Group keys, or organization roles as key:role, whose people may sign in to this client. Empty lets everyone in."
+          argument :forward_auth_rules, GraphQL::Types::JSON, required: false,
+                   description: "The ordered rules forward auth follows, for an app behind a proxy only. Each rule has `paths` " \
+                                "(absolute, with * for one segment and ** for any depth), `methods`, `networks` (addresses or ranges), " \
+                                "and `groups` it covers, and an `outcome` of open, one_factor, two_factor, token, or deny. Empty removes them all."
           argument :sign_in_policy, ID, required: false
           argument :client_uri, String, required: false
           argument :logo_uri, String, required: false

data/app/graphql/masks/server/manage/mutations/update_group.rb

@@ -3,19 +3,22 @@ module Masks
     module Manage
       module Mutations
         class UpdateGroup < BaseMutation
+          include GroupSource
+
           requires :security
 
           argument :key, String
-          argument :name, String
+          argument :name, String, required: false
 
           field :group, Types::GroupType, null: false
 
-          def resolve(key:, name:)
+          def resolve(key:, name: nil, **source)
             group = group!(key)
-            group.name = name
+            group.name = name unless name.nil?
+            fill_source(group, **source)
             save!(group)
 
-            { group: group }
+            { group: group.reload }
           end
         end
       end

data/app/graphql/masks/server/manage/mutations/update_tenant.rb

@@ -30,14 +30,27 @@ module Masks
           argument :key_rotation_days, Integer, required: false,
                    description: "Days between scheduled signing key rotations, from 7 to 365. Zero leaves rotation to a manager."
 
+          argument :invitation_lifetime, Integer, required: false,
+                   description: "Seconds an invitation to an account stays valid, from an hour to 30 days. Zero goes back to 7 days."
+          argument :organization_invitation_lifetime, Integer, required: false,
+                   description: "Seconds an invitation to an organization stays open after it was last sent, from an hour to 30 days. Zero goes back to 14 days."
+          argument :password_reset_lifetime, Integer, required: false,
+                   description: "Seconds a password reset link stays valid, from 5 minutes to a day. Zero goes back to 30 minutes."
+          argument :email_verification_lifetime, Integer, required: false,
+                   description: "Seconds an email confirmation link stays valid, from an hour to 14 days. Zero goes back to 2 days."
+
           field :tenant, Types::TenantType, null: false
 
           def resolve(name: nil, dynamic_client_scopes: nil, dynamic_registration: nil,
                       named_by: nil, browsers_only: nil, blocked_agents: nil, sign_in_policy: nil,
                       suspend_after: nil, delete_after: nil, event_retention_days: nil, risky_networks: nil,
-                      accent_color: nil, key_rotation_days: nil, ldap_enabled: nil, ldap_password_only: nil)
+                      accent_color: nil, key_rotation_days: nil, ldap_enabled: nil, ldap_password_only: nil, **link_lifetimes)
             tenant = Current.tenant
 
+            link_lifetimes.compact.each do |name, seconds|
+              tenant[name] = seconds.zero? ? Masks::Server::Tenant.default_link_lifetime(name) : seconds
+            end
+
             tenant.name = name unless name.nil?
             tenant.accent_color = accent_color unless accent_color.nil?
             tenant.key_rotation_days = key_rotation_days.zero? ? nil : key_rotation_days unless key_rotation_days.nil?

data/app/graphql/masks/server/manage/types/access_request_type.rb

@@ -0,0 +1,21 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class AccessRequestType < BaseObject
+          description "An actor turned away from a client who asked for access. Granting it puts them in one of the groups the client allows."
+
+          field :id, ID, null: false
+          field :actor, ActorType, null: false
+          field :client, ClientType, null: false
+          field :label, String, description: "The group key, or organization role as key:role, the actor was put in. Null until granted."
+          field :decided_by, ActorType
+          field :granted_at, GraphQL::Types::ISO8601DateTime
+          field :declined_at, GraphQL::Types::ISO8601DateTime
+          field :open, Boolean, null: false, method: :open?, description: "True while nobody has granted or declined it."
+          field :created_at, GraphQL::Types::ISO8601DateTime, null: false
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/actor_type.rb

@@ -32,6 +32,8 @@ module Masks
           field :tokens, [ "Masks::Server::Manage::Types::TokenType" ], null: false
           field :memberships, [ "Masks::Server::Manage::Types::MembershipType" ], null: false
           field :groups, [ "Masks::Server::Manage::Types::GroupType" ], null: false
+          field :group_memberships, [ "Masks::Server::Manage::Types::GroupMemberType" ], null: false,
+                description: "Each group the person is in, with what put them there."
           field :group_labels, [ String ], null: false,
                 description: "What the groups claim carries: each group's key, and each organization role as key:role."
 
@@ -130,6 +132,10 @@ module Masks
             object.memberships.includes(:organization).joins(:organization).order("organizations.name")
           end
 
+          def group_memberships
+            object.group_members.includes(:group).joins(:group).order("groups.name")
+          end
+
           def tokens
             Masks::Server::Token.where(kind: TokenType::GRANTS, actor_id: object.id)
                    .live

data/app/graphql/masks/server/manage/types/client_type.rb

@@ -20,6 +20,10 @@ module Masks
                 description: "Seconds from a sign-in until its refresh tokens stop, however often they are used. Null is 90 days."
           field :allowed_groups, [ String ], null: false,
                 description: "Group keys, or organization roles as key:role, whose people may sign in. Empty lets everyone in."
+          field :forward_auth_rules, GraphQL::Types::JSON, null: false,
+                description: "The ordered rules forward auth follows for an app behind a proxy. Each has `paths`, `methods`, " \
+                             "`networks`, and `groups` it covers, and an `outcome` of open, one_factor, two_factor, token, or deny. " \
+                             "The first rule that covers a request decides it. With no rule, a signed-in person who may sign in is let through."
           field :namespaces, [ "Masks::Server::Manage::Types::NamespaceType" ], null: false
           field :token_endpoint_auth_method, String, null: false
           field :subject_type, String, null: false
@@ -55,6 +59,8 @@ module Masks
                 description: "Where masks posts a signed LogoutRequest when a person who signed in to this SAML application signs out, and its LogoutResponse when the application asks."
           field :require_signed_request_object, Boolean, null: false
           field :consent_required, Boolean, null: false
+          field :app_passwords, Boolean, null: false,
+                description: "Whether people may make an app password for this client, which LDAP and forward auth accept in place of their password and second factor."
           field :sign_in_policy, SignInPolicyType
           field :dynamic, Boolean, null: false
           field :approved_at, GraphQL::Types::ISO8601DateTime
@@ -65,6 +71,8 @@ module Masks
                 description: "The machines this app enrolled that are not archived."
           field :last_seen_at, GraphQL::Types::ISO8601DateTime,
                 description: "When this client last got a token. Null if it never has."
+          field :access_requests, [ "Masks::Server::Manage::Types::AccessRequestType" ], null: false,
+                description: "Actors turned away from this client who asked for access and are waiting."
           field :archived_at, GraphQL::Types::ISO8601DateTime
           field :secret_expires_at, GraphQL::Types::ISO8601DateTime
           field :created_at, GraphQL::Types::ISO8601DateTime, null: false
@@ -87,6 +95,10 @@ module Masks
             object.enrolled.active.order(:name)
           end
 
+          def access_requests
+            object.access_requests.open.includes(:actor).order(:created_at)
+          end
+
           def last_seen_at
             Masks::Server::Token.where(kind: TokenType::GRANTS, client_id: object.id).maximum(:created_at)
           end

data/app/graphql/masks/server/manage/types/group_condition_input.rb

@@ -0,0 +1,16 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class GroupConditionInput < GraphQL::Schema::InputObject
+          description "One condition of a group's rule."
+
+          argument :kind, String, description: "email_domain or profile."
+          argument :field, String, required: false,
+                   description: "For profile: name, given_name, family_name, middle_name, nickname, gender, zoneinfo, or locale."
+          argument :value, String, description: "The domain a verified email address ends with, or the value the profile field equals."
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/group_condition_type.rb

@@ -0,0 +1,29 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class GroupConditionType < BaseObject
+          description "One condition of a group's rule. Every condition must hold for a person to be in the group."
+
+          field :kind, String, null: false, description: "email_domain or profile."
+          field :field, String, description: "The profile field a profile condition reads."
+          field :value, String, null: false,
+                description: "The domain a verified email address ends with, or the value the profile field equals. " \
+                             "A profile condition matches only people whose profile a directory sets."
+
+          def kind
+            object["kind"]
+          end
+
+          def field
+            object["field"]
+          end
+
+          def value
+            object["value"]
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/group_member_type.rb

@@ -0,0 +1,16 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class GroupMemberType < BaseObject
+          description "A person's place in a group, and what put them there."
+
+          field :group, GroupType, null: false
+          field :actor, ActorType, null: false
+          field :sourced_by, String, description: "rule, provider, or group when the group's source put them in. Null when a manager added them by hand."
+          field :created_at, GraphQL::Types::ISO8601DateTime, null: false
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/group_type.rb

@@ -3,14 +3,26 @@ module Masks
     module Manage
       module Types
         class GroupType < BaseObject
-          description "A named set of people in the tenant. The groups claim lists the key of each group a person is in."
+          description "A named set of people in the tenant. The groups claim lists the key of each group a person is in. " \
+                      "A group fills by hand, from a rule, from a provider, or from other groups."
 
           field :key, String, null: false
           field :name, String, null: false
+          field :source, String, null: false, description: "manual, rule, provider, or group."
+          field :rule, [ GroupConditionType ], null: false, description: "The conditions a rule group checks. Empty unless the source is rule."
+          field :provider_key, String, description: "The provider a provider group reads at sign-in."
+          field :upstream_group, String, description: "The group name the provider lists for people who belong."
+          field :parent_labels, [ String ], null: false, description: "The group keys and organization roles, as key:role, a nested group holds everyone from."
+          field :refreshed_at, GraphQL::Types::ISO8601DateTime, description: "When the source last filled the group."
           field :member_count, Integer, null: false
           field :members, [ ActorType ], null: false
+          field :memberships, [ GroupMemberType ], null: false, description: "Each member with what put them in the group."
           field :created_at, GraphQL::Types::ISO8601DateTime, null: false
 
+          def provider_key
+            object.provider&.key
+          end
+
           def member_count
             object.members.count
           end
@@ -18,6 +30,10 @@ module Masks
           def members
             object.actors.order(:nickname)
           end
+
+          def memberships
+            object.members.includes(:actor).sort_by { |member| member.actor.nickname.to_s }
+          end
         end
       end
     end

data/app/graphql/masks/server/manage/types/health_check_type.rb

@@ -0,0 +1,18 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class HealthCheckType < BaseObject
+          description "The latest result of one health check. Checks run every 10 minutes."
+
+          field :name, ID, null: false, description: "jobs, worker, queue, ldap, metrics, mail, origin, domains, keys, or proxy."
+          field :status, String, null: false, description: "ok, warning, or failing."
+          field :summary, String, null: false, description: "A short word for what the check found, such as none, stale, or silent."
+          field :details, GraphQL::Types::JSON, null: false, description: "The figures and names behind the summary."
+          field :checked_at, GraphQL::Types::ISO8601DateTime, null: false
+          field :changed_at, GraphQL::Types::ISO8601DateTime, null: false, description: "When the status last changed."
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/ldap_credential_type.rb

@@ -7,6 +7,7 @@ module Masks
           field :label, String, null: false
           field :bind_dn, String, null: false, description: "The DN an app binds as, under ou=services in this tenant's directory."
           field :issued_by, ActorType
+          field :client, ClientType, description: "The client whose app passwords bind through this credential, when one was chosen."
           field :used_at, GraphQL::Types::ISO8601DateTime, description: "When an app last bound with it, to within five minutes."
           field :created_at, GraphQL::Types::ISO8601DateTime, null: false
 

data/app/graphql/masks/server/manage/types/mutation_type.rb

@@ -28,6 +28,9 @@ module Masks
           field :delete_group, mutation: Mutations::DeleteGroup
           field :add_group_member, mutation: Mutations::AddGroupMember
           field :remove_group_member, mutation: Mutations::RemoveGroupMember
+          field :grant_access, mutation: Mutations::GrantAccess
+          field :decline_access, mutation: Mutations::DeclineAccess
+          field :refresh_group, mutation: Mutations::RefreshGroup
           field :disable_code_factor, mutation: Mutations::DisableCodeFactor
           field :revoke_passkey, mutation: Mutations::RevokePasskey
           field :upload_avatar, mutation: Mutations::UploadAvatar
@@ -97,6 +100,7 @@ module Masks
           field :activate_signing_key, mutation: Mutations::ActivateSigningKey
           field :discard_signing_key, mutation: Mutations::DiscardSigningKey
           field :rotate_signing_key, mutation: Mutations::RotateSigningKey
+          field :run_health_checks, mutation: Mutations::RunHealthChecks
         end
       end
     end

data/app/graphql/masks/server/manage/types/query_type.rb

@@ -191,6 +191,13 @@ module Masks
 
           field :event_actions, [ EventActionType ], null: false
 
+          field :health, [ HealthCheckType ], null: false,
+                description: "The latest result of each health check for this tenant and the server it runs on. " \
+                             "Empty until the first scheduled run."
+          field :release, ReleaseType,
+                description: "The newest release when it is newer than this server. Null while the server is current, " \
+                             "or while MASKS_RELEASE_CHECK is off."
+
           LIMIT = 50
           CEILING = 200
           SPAN = 30
@@ -464,6 +471,23 @@ module Masks
             Masks::Server::Event::ACTIONS.sort
           end
 
+          def health
+            Masks::Server::HealthCheck.by_name
+          end
+
+          def release
+            found = Masks::Server::Release.available
+
+            return nil if found.nil?
+
+            {
+              version: found["version"],
+              url: found["url"],
+              operator_step: found["operator_step"] == true,
+              checked_at: Time.iso8601(found["checked_at"])
+            }
+          end
+
           private
 
             def actor_scope(search: nil, activated: nil, holds: nil, pending_approval: nil, recovery_requested: nil,

data/app/graphql/masks/server/manage/types/release_type.rb

@@ -0,0 +1,16 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class ReleaseType < BaseObject
+          description "A newer release of masks than the one this server runs."
+
+          field :version, String, null: false
+          field :url, String, null: false, description: "The release notes."
+          field :operator_step, Boolean, null: false, description: "Whether the release notes carry a line that starts with Operator:."
+          field :checked_at, GraphQL::Types::ISO8601DateTime, null: false
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/tenant_type.rb

@@ -9,7 +9,7 @@ module Masks
           field :origins, [ String ], null: false, description: "Every origin this tenant answers on, each its own issuer."
 
           def origins
-            [ object.templated_origin, object.custom_origin ].compact
+            [ object.templated_origin || object.held_origin, object.custom_origin ].compact
           end
           field :name, String, null: false
           field :named_by, String, null: false
@@ -31,6 +31,11 @@ module Masks
           def event_retention_days
             object.event_retention.in_days.round
           end
+          field :invitation_lifetime, Integer, null: false, description: "Seconds an invitation to an account stays valid."
+          field :organization_invitation_lifetime, Integer, null: false,
+                                                            description: "Seconds an invitation to an organization stays open after it was last sent."
+          field :password_reset_lifetime, Integer, null: false, description: "Seconds a password reset link stays valid."
+          field :email_verification_lifetime, Integer, null: false, description: "Seconds an email confirmation link stays valid."
           field :ldap_enabled, Boolean, null: false, description: "Whether the LDAP directory answers for this tenant.", method: :ldap?
           field :ldap_password_only, Boolean, null: false,
                                      description: "Whether a password alone binds to LDAP for an account that would otherwise need a second factor.",

data/app/helpers/masks/server/account_helper.rb

@@ -29,6 +29,10 @@ module Masks
         t("account.index.#{key}", **options)
       end
 
+      def account_access_requests(organization)
+        AccessRequest.for_organization(organization).includes(:actor, :client).order(:created_at)
+      end
+
       def account_roster(organization)
         organization.memberships.sort_by do |member|
           [ member.pending? ? 1 : 0, member.owner? ? 0 : 1, Members.label(member).to_s.downcase ]

data/app/jobs/masks/server/cleanup_job.rb

@@ -34,6 +34,7 @@ module Masks
           Members.purge_lapsed!
           Replay.where(expires_at: ...Time.current).in_batches(of: BATCH).delete_all
           ReleasedNickname.lapsed.in_batches(of: BATCH).delete_all
+          AccessRequest.lapsed.in_batches(of: BATCH).delete_all
         end
 
         def sweep_tokens(cutoff)