masks-server 0.11.0 → 0.13.0

data/app/jobs/masks/server/health_check_job.rb

@@ -0,0 +1,21 @@
+module Masks
+  module Server
+    class HealthCheckJob < ApplicationJob
+      queue_as :maintenance
+      across_tenants!
+
+      def perform
+        server = Health.server_results
+        failing = Hash.new { |held, name| held[name] = [] }
+
+        begin
+          each_tenant do |tenant|
+            Health.store!(server + Health.tenant_results).select(&:failing?).each { |row| failing[row.name] << tenant.subdomain }
+          end
+        ensure
+          Health.remember_all!(failing)
+        end
+      end
+    end
+  end
+end

data/app/jobs/masks/server/refresh_groups_job.rb

@@ -0,0 +1,18 @@
+module Masks
+  module Server
+    class RefreshGroupsJob < ApplicationJob
+      queue_as :maintenance
+      across_tenants!
+
+      def perform
+        each_tenant { refresh }
+      end
+
+      private
+
+        def refresh
+          Group.sourced.find_each(&:refresh!)
+        end
+    end
+  end
+end

data/app/jobs/masks/server/release_check_job.rb

@@ -0,0 +1,21 @@
+module Masks
+  module Server
+    class ReleaseCheckJob < ApplicationJob
+      queue_as :maintenance
+      across_tenants!
+
+      def perform
+        return unless ::Rails.configuration.masks.release_check
+
+        found = Release.check!
+
+        return if found.nil?
+
+        each_tenant do
+          Event.record!(Event::RELEASE_AVAILABLE, by: nil, version: found["version"], url: found["url"],
+                                                  operator_step: found["operator_step"])
+        end
+      end
+    end
+  end
+end

data/app/ldap/masks/server/ldap/connection.rb

@@ -58,7 +58,7 @@ module Masks
 
           def bind(message)
             request = message.operation
-            @bound = nil
+            previous, @bound = @bound, nil
 
             if request.version != 3
               return write(Protocol.bind_response(message.id, Protocol::PROTOCOL_ERROR, "only LDAPv3 is spoken here"))
@@ -68,7 +68,8 @@ module Masks
               return write(Protocol.bind_response(message.id, Protocol::AUTH_METHOD_NOT_SUPPORTED, "only simple binds are supported"))
             end
 
-            outcome = Gate.new(ip_address: @ip_address).bind(request.name, request.password)
+            outcome = Gate.new(ip_address: @ip_address, client_id: previous&.service? ? previous.client_id : nil)
+                          .bind(request.name, request.password)
             @bound = outcome.bound
 
             write(Protocol.bind_response(message.id, outcome.code, outcome.message))

data/app/ldap/masks/server/ldap/gate.rb

@@ -2,10 +2,13 @@ module Masks
   module Server
     module Ldap
       class Gate
-        WINDOW = 3.minutes
         VIA = "ldap".freeze
 
-        Bound = Data.define(:kind, :tenant, :dn, :subject) do
+        Bound = Data.define(:kind, :tenant, :dn, :subject, :client_id) do
+          def initialize(client_id: nil, **rest)
+            super(client_id: client_id, **rest)
+          end
+
           def service?
             kind == :service
           end
@@ -17,15 +20,16 @@ module Masks
 
         Outcome = Data.define(:code, :message, :bound)
 
-        def initialize(ip_address:)
+        def initialize(ip_address:, client_id: nil)
           @ip_address = ip_address
+          @client_id = client_id
         end
 
         def bind(name, password)
           password = password.to_s
           return anonymous if name.blank? && password.empty?
           return refused(Protocol::UNWILLING_TO_PERFORM, "unauthenticated binds are refused") if password.empty?
-          return throttled if failures(ip_key) >= ::Rails.configuration.masks.attempt_limit
+          return throttled(:attempt) if Throttle.exceeded?(:attempt, ip_key)
 
           dn = parse(name)
           tenant = dn && Directory.tenant_for(dn)
@@ -80,22 +84,24 @@ module Masks
 
             Outcome.new(
               code: Protocol::SUCCESS, message: "",
-              bound: Bound.new(kind: :service, tenant: tenant, dn: directory.service_dn(credential.label), subject: credential.id)
+              bound: Bound.new(kind: :service, tenant: tenant, dn: directory.service_dn(credential.label), subject: credential.id,
+                               client_id: credential.client_id)
             )
           end
 
           def person(tenant, directory, uid, password)
             account = account_key(tenant, uid)
 
-            if failures(account) >= ::Rails.configuration.masks.account_attempt_limit
-              Event.record!(Event::LOGIN_THROTTLED, actor: Actor.locate(uid), by: nil, identifier: uid, via: VIA)
+            if Throttle.exceeded?(:account_attempt, account)
+              Throttle.hit!(:account_attempt, actor: Actor.locate(uid), address: @ip_address, identifier: uid, via: VIA)
               return throttled
             end
 
             actor = Actor.authenticate(uid, password)
+            return app_password(tenant, directory, uid, password, account) if actor.nil? && app_password?(password)
 
             if actor.nil?
-              failed!(ip_key, account)
+              failed!(account)
               return refuse(uid, "password")
             end
 
@@ -103,8 +109,28 @@ module Masks
             return refuse(uid, reason, actor) if reason
 
             actor.active!
+            bound(tenant, directory, actor)
+          end
+
+          def app_password?(password)
+            @client_id && AppPassword.shaped?(password)
+          end
+
+          def app_password(tenant, directory, uid, password, account)
+            client = Client.active.find_by(id: @client_id)
+            outcome = AppPasswords.authenticate(client: client, identifier: uid, secret: password, via: VIA,
+                                                ip_address: @ip_address, tenant: tenant)
+
+            return throttled if outcome.throttled?
+            return bound(tenant, directory, outcome.actor, factor: AppPasswords::FACTOR) if outcome.actor
+
+            failed!(account) if outcome.wrong?
+            invalid
+          end
+
+          def bound(tenant, directory, actor, factor: "password")
             dn = directory.person_dn(actor)
-            Event.record!(Event::LDAP_BOUND, actor: actor, dn: dn.to_s)
+            Event.record!(Event::LDAP_BOUND, actor: actor, dn: dn.to_s, factor: factor)
 
             Outcome.new(code: Protocol::SUCCESS, message: "", bound: Bound.new(kind: :person, tenant: tenant, dn: dn, subject: actor.id))
           end
@@ -132,7 +158,7 @@ module Masks
 
           def decoy(password)
             BCrypt::Password.new(Actor.decoy_digest) == password
-            failed!(ip_key)
+            Throttle.count!(:attempt, ip_key)
             invalid
           end
 
@@ -140,7 +166,9 @@ module Masks
             refused(Protocol::INVALID_CREDENTIALS, "invalid credentials")
           end
 
-          def throttled
+          def throttled(limit = nil)
+            Throttle.hit!(limit, address: @ip_address) if limit
+
             refused(Protocol::UNWILLING_TO_PERFORM, "too many attempts; wait a few minutes")
           end
 
@@ -149,19 +177,16 @@ module Masks
           end
 
           def ip_key
-            "ldap-attempts:ip:#{@ip_address}"
+            "ldap:#{@ip_address}"
           end
 
           def account_key(tenant, uid)
-            "ldap-attempts:#{tenant.id}:#{Digest::SHA256.hexdigest(uid.to_s.strip.downcase)}"
-          end
-
-          def failures(key)
-            ::Rails.cache.read(key).to_i
+            "ldap:#{tenant.id}:#{Digest::SHA256.hexdigest(uid.to_s.strip.downcase)}"
           end
 
-          def failed!(*keys)
-            keys.each { |key| ::Rails.cache.increment(key, 1, expires_in: WINDOW) }
+          def failed!(account)
+            Throttle.count!(:attempt, ip_key)
+            Throttle.count!(:account_attempt, account)
           end
       end
     end

data/app/logins/masks/server/login_states/second_factor.rb

@@ -11,7 +11,7 @@ module Masks
         end
 
         prompts "second-factor" do
-          login.first_factored? && !login.second_factored?
+          login.first_factored? && !login.second_factored? && !login.relaxed?
         end
 
         def factor!

data/app/mailers/masks/server/actor_mailer.rb

@@ -160,6 +160,37 @@ module Masks
         )
       end
 
+      def access_granted(asked, journey:)
+        return message unless deliverable?
+
+        journey!(journey)
+        @actor = asked.actor
+        @app = asked.client
+        @url = (@app.approved? && @app.client_uri.presence) || home
+
+        mail(
+          from: self.class.from,
+          to: @actor.email,
+          subject: customize!(:access_granted, actor: @actor, app: @app.name,
+                                               default: t("actor_mailer.access_granted.subject", app: @app.name))
+        )
+      end
+
+      def access_declined(asked, journey:)
+        return message unless deliverable?
+
+        journey!(journey)
+        @actor = asked.actor
+        @app = asked.client
+
+        mail(
+          from: self.class.from,
+          to: @actor.email,
+          subject: customize!(:access_declined, actor: @actor, app: @app.name,
+                                                default: t("actor_mailer.access_declined.subject", app: @app.name))
+        )
+      end
+
       private
 
         def tenant_lede(manager)

data/app/models/masks/server/access_request.rb

@@ -0,0 +1,103 @@
+module Masks
+  module Server
+    class AccessRequest < ApplicationRecord
+      include TenantScoped
+
+      class Refused < StandardError; end
+
+      LIFETIME = 30.days
+
+      belongs_to :actor
+      belongs_to :client
+      belongs_to :decided_by, class_name: "Actor", optional: true
+
+      scope :open, -> { where(granted_at: nil, declined_at: nil) }
+      scope :lapsed, -> { where(created_at: ...LIFETIME.ago) }
+      scope :newest_first, -> { order(created_at: :desc) }
+
+      class << self
+        def ask!(actor:, client:)
+          return nil if client.admits?(actor)
+
+          open.find_by(actor: actor, client: client) || begin
+            created = create!(actor: actor, client: client)
+            Event.record!(Event::ACCESS_REQUESTED, actor: actor, client: client)
+            created
+          end
+        rescue ActiveRecord::RecordNotUnique
+          open.find_by!(actor: actor, client: client)
+        end
+
+        def for_organization(organization)
+          open.joins(:client).where("EXISTS (SELECT 1 FROM unnest(clients.allowed_groups) AS held WHERE held LIKE ?)",
+                                   "#{sanitize_sql_like(organization.key)}:%")
+        end
+      end
+
+      def open?
+        granted_at.nil? && declined_at.nil?
+      end
+
+      def grant!(label: nil, by:, journey:)
+        raise Refused, "#{actor.identifier} is already admitted to #{client.name}" if client.admits?(actor)
+        raise Refused, "this request is already decided" unless open?
+
+        chosen = label.presence || client.allowed_groups.first
+        raise Refused, "#{chosen} is not one of the groups #{client.name} allows" unless client.allowed_groups.include?(chosen)
+
+        transaction do
+          admit!(chosen, by: by)
+          update!(granted_at: Time.current, decided_by: by, label: chosen)
+          Event.record!(Event::ACCESS_GRANTED, actor: actor, by: by, client: client, label: chosen)
+        end
+
+        ActorMailer.access_granted(self, journey: journey).deliver_later if actor.email.present?
+
+        self
+      end
+
+      def decline!(by:, journey:)
+        raise Refused, "this request is already decided" unless open?
+
+        transaction do
+          update!(declined_at: Time.current, decided_by: by)
+          Event.record!(Event::ACCESS_DECLINED, actor: actor, by: by, client: client)
+        end
+
+        ActorMailer.access_declined(self, journey: journey).deliver_later if actor.email.present?
+
+        self
+      end
+
+      def organization_roles
+        client.allowed_groups.filter_map do |held|
+          key, role = held.split(":", 2)
+          [ key, role ] if role
+        end
+      end
+
+      private
+
+        def admit!(label, by:)
+          key, role = label.split(":", 2)
+
+          if role.nil?
+            group = Group.find_by(key: key) || raise(Refused, "there is no group keyed #{key}")
+            group.add!(actor, by: by)
+          else
+            organization = Organization.active.find_by(key: key) || raise(Refused, "there is no organization keyed #{key}")
+            held = organization.memberships.find_by(actor: actor)
+            held = held.destroy! && nil if held&.pending?
+
+            if held.nil?
+              Members.enroll!(organization, actor, role: role, by: by)
+            elsif held.role != role
+              Members.assign!(held, role: role, by: by)
+            end
+          end
+        rescue Members::Refused => e
+          raise Refused, e.message
+        end
+    end
+  end
+end

data/app/models/masks/server/actor.rb

@@ -30,6 +30,7 @@ module Masks
       has_many :approvals, class_name: "Client", foreign_key: :approved_by_id, dependent: :nullify
       has_one :avatar, dependent: :destroy
       has_many :group_members, dependent: :delete_all
+      has_many :access_requests, dependent: :delete_all
       has_many :groups, through: :group_members
 
       before_destroy :sign_out_everywhere!, prepend: true
@@ -61,6 +62,7 @@ module Masks
       after_save :release_previous_nickname, if: :saved_change_to_nickname?
       before_save :forget_code_factors_for_new_addresses
       after_update :forget_mailed_links, if: :saved_change_to_email?
+      after_commit :settle_sourced_groups, on: %i[create update], if: -> { saved_changes.keys.intersect?(Group::WATCHED) }
 
       normalizes :nickname, with: ->(value) { value.to_s.strip.presence }
       normalizes :email, with: ->(value) { value.to_s.strip.downcase.presence }
@@ -469,6 +471,10 @@ module Masks
 
       private
 
+        def settle_sourced_groups
+          Group.ruled.find_each { |group| group.settle!(self) }
+        end
+
         def forget_mailed_links
           [ PasswordReset, Invitation, EmailVerification ].each do |kind|
             kind.where(actor_id: id).live.find_each(&:consume!)

data/app/models/masks/server/app_password.rb

@@ -0,0 +1,91 @@
+module Masks
+  module Server
+    class AppPassword < Token
+      ALPHABET = "abcdefghjkmnpqrstuvwxyz23456789".freeze
+      LENGTH = 24
+      GROUP = 4
+      LIFETIME = 100.years
+      NAME_LIMIT = 64
+      MOST = 20
+      USED_GRAIN = 1.minute
+
+      class Refused < StandardError; end
+
+      scope :newest_first, -> { order(created_at: :desc) }
+
+      class << self
+        def offered(actor)
+          Client.active.where(app_passwords: true).order(:name).select { |client| client.admits?(actor) }
+        end
+
+        def issue!(actor:, client:, name:)
+          label = name.to_s.strip
+
+          raise Refused, "name" if label.empty? || label.length > NAME_LIMIT
+          raise Refused, "app" if client.nil? || offered(actor).none? { |offered| offered.id == client.id }
+          raise Refused, "too_many" if live.where(actor: actor).count >= MOST
+
+          secret = Array.new(LENGTH) { ALPHABET[SecureRandom.random_number(ALPHABET.length)] }.join
+          held = create!(actor: actor, client: client, digest: BCrypt::Password.create(secret, cost: cost),
+                         payload: { "name" => label }, expires_at: LIFETIME.from_now)
+          held.instance_variable_set(:@secret, grouped(secret))
+          held
+        end
+
+        def normalize(secret)
+          secret.to_s.downcase.delete("- ")
+        end
+
+        def shaped?(secret)
+          offered = normalize(secret)
+
+          offered.length == LENGTH && offered.each_char.all? { |char| ALPHABET.include?(char) }
+        end
+
+        def check(actor:, client:, secret:)
+          offered = normalize(secret)
+          return burn(offered) unless actor && client && shaped?(offered)
+
+          found = live.where(actor: actor, client: client).to_a.find { |held| BCrypt::Password.new(held.digest) == offered }
+
+          found || burn(offered)
+        end
+
+        def grouped(secret)
+          secret.scan(/.{1,#{GROUP}}/o).join("-")
+        end
+
+        private
+
+          def cost
+            ActiveModel::SecurePassword.min_cost ? BCrypt::Engine::MIN_COST : BCrypt::Engine.cost
+          end
+
+          def burn(secret)
+            BCrypt::Password.new(Actor.decoy_digest) == secret
+            nil
+          end
+      end
+
+      def name
+        held("name")
+      end
+
+      def used_at
+        held("used_at")&.then { |value| Time.zone.parse(value) }
+      end
+
+      def used!
+        return if used_at && used_at > USED_GRAIN.ago
+
+        now = Time.current
+        today = now.to_date.iso8601
+        first_today = held("used_on") != today
+
+        update_columns(payload: (payload || {}).merge("used_at" => now.iso8601, "used_on" => today))
+
+        Event.record!(Event::APP_PASSWORD_USED, actor: actor, client: client, name: name) if first_today
+      end
+    end
+  end
+end

data/app/models/masks/server/app_passwords.rb

@@ -0,0 +1,76 @@
+module Masks
+  module Server
+    module AppPasswords
+      FACTOR = "app_password".freeze
+      THROTTLED = "throttled".freeze
+      SCOPE = "masks/server/logins".freeze
+
+      Outcome = Data.define(:actor, :refusal) do
+        def throttled?
+          refusal == THROTTLED
+        end
+
+        def wrong?
+          refusal == FACTOR
+        end
+      end
+
+      class << self
+        def authenticate(client:, identifier:, secret:, via:, ip_address: Current.ip_address, tenant: Current.tenant)
+          return refused(nil, identifier, "factor-not-offered", via, client) unless client&.app_passwords? && !client.archived?
+
+          actor = Actor.locate(identifier)
+          keys = { account_attempt: [ account_key(tenant, actor, identifier), "identifier" ], attempt: [ address_key(tenant, ip_address), nil ] }
+          exceeded = keys.find { |limit, (by, named)| Throttle.exceeded?(limit, by, scope: SCOPE, named: named) }&.first
+
+          if exceeded
+            Throttle.hit!(exceeded, actor: actor, client: client, address: ip_address, identifier: identifier, via: via)
+            return Outcome.new(actor: nil, refusal: THROTTLED)
+          end
+
+          held = AppPassword.check(actor: actor, client: client, secret: secret)
+
+          if held.nil?
+            failed!(keys)
+            return refused(actor, identifier, FACTOR, via, client)
+          end
+
+          reason = obstacle(client, actor)
+          return refused(actor, identifier, reason, via, client) if reason
+
+          actor.active!
+          held.used!
+
+          Outcome.new(actor: actor, refusal: nil)
+        end
+
+        private
+
+          def obstacle(client, actor)
+            return "suspended" if actor.suspended?
+            return "pending_approval" if actor.pending_approval_at.present?
+
+            "not_admitted" unless client.admits?(actor)
+          end
+
+          def refused(actor, identifier, factor, via, client)
+            Event.record!(Event::LOGIN_REFUSED, actor: actor, by: nil, client: client, factor: factor, identifier: identifier, via: via)
+
+            Outcome.new(actor: nil, refusal: factor)
+          end
+
+          def account_key(tenant, actor, identifier)
+            [ tenant.id, actor&.id || identifier.to_s.strip.downcase ].join(":")
+          end
+
+          def address_key(tenant, ip_address)
+            [ tenant.id, ip_address ].join(":")
+          end
+
+          def failed!(keys)
+            keys.each { |limit, (by, named)| Throttle.count!(limit, by, scope: SCOPE, named: named) }
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/client.rb

@@ -54,6 +54,7 @@ module Masks
       has_many :consents, dependent: :destroy
       has_many :delegations, dependent: :destroy
       has_many :saml_participations, dependent: :delete_all
+      has_many :access_requests, dependent: :delete_all
       has_many :namespaces, -> { order(:name) }, dependent: :nullify
       has_many :enrolled, class_name: "Client", foreign_key: :enrolled_by_id, inverse_of: :enrolled_by,
                           dependent: :nullify
@@ -73,6 +74,7 @@ module Masks
       validate :keys_are_usable
       validate :saml_is_described, if: :saml?
       validate :forward_is_described, if: :forward?
+      validate :forward_auth_rules_are_usable
       validate :backchannel_logout_uri_is_usable
       validate :sector_is_derivable
       validate :consent_is_skipped_only_when_approved
@@ -89,6 +91,7 @@ module Masks
 
       normalizes :allowed_groups, with: ->(value) { Array(value).map { |group| group.to_s.strip.downcase }.compact_blank.uniq.sort }
       normalizes :saml_entity_id, :saml_slo_url, with: ->(value) { value.to_s.strip.presence }
+      normalizes :forward_auth_rules, with: ->(value) { ForwardAuthRules.normalize(value) }
       normalizes(*METADATA_URIS, with: ->(value) { value.to_s.strip.presence })
 
       after_commit :refresh_logo!, on: %i[create update], if: :saved_change_to_logo_uri?
@@ -464,6 +467,10 @@ module Masks
         allowed_groups.empty? || actor.group_labels.intersect?(allowed_groups)
       end
 
+      def forward_rules
+        ForwardAuthRules.new(forward_auth_rules)
+      end
+
       def permitted_scopes(requested)
         return scope_list if Scopes.list(requested).empty?
 
@@ -604,6 +611,14 @@ module Masks
           errors.add(:grant_types, "not supported: #{unknown.join(', ')}") if unknown.any?
         end
 
+        def forward_auth_rules_are_usable
+          held = forward_auth_rules
+
+          return errors.add(:base, "forward auth rules apply only to an app behind a proxy") if held.present? && !forward?
+
+          ForwardAuthRules.problems(held).each { |problem| errors.add(:base, problem) }
+        end
+
         def forward_is_described
           errors.add(:grant_types, "are not used by an app behind a proxy") if grant_types.any?
           errors.add(:token_endpoint_auth_method, "is none for an app behind a proxy") unless public?

data/app/models/masks/server/client_metadata_document.rb

@@ -12,7 +12,6 @@ module Masks
       LONGEST = 24.hours
       REFUSAL_LIFETIME = 5.minutes
       NAME_LIMIT = 100
-      WINDOW = 10.minutes
       TENANT_FACTOR = 10
       AUTH_METHODS = %w[none private_key_jwt].freeze
       DEFAULT_AUTH_METHOD = "none".freeze
@@ -62,14 +61,11 @@ module Masks
         end
 
         def crowded?
-          limit = ::Rails.configuration.masks.registration_limit
-          key = "masks:client-metadata-documents:#{Current.tenant&.id}:#{Time.current.to_i / WINDOW.to_i}"
-          here = ::Rails.cache.increment("#{key}:#{Current.ip_address}", 1, expires_in: WINDOW)
-          anywhere = ::Rails.cache.increment(key, 1, expires_in: WINDOW)
+          tenant = Current.tenant&.id
+          here = Throttle.crowded?(:registration, "documents:#{tenant}:#{Current.ip_address}")
+          anywhere = Throttle.crowded?(:registration, "documents:#{tenant}", times: TENANT_FACTOR)
 
-          (here.to_i > limit || anywhere.to_i > limit * TENANT_FACTOR).tap do |crowded|
-            ::Rails.logger.info("masks: too many new client metadata documents") if crowded
-          end
+          (here || anywhere).tap { |crowded| Throttle.hit!(:registration, document: true) if crowded }
         end
 
         def refusal_key(client_id)

data/app/models/masks/server/confirmation_code.rb

@@ -31,7 +31,7 @@ module Masks
 
         def inbox_crowded?(address:, ip: nil)
           recent = inbox.where(created_at: WINDOW.ago..)
-          limit = ::Rails.configuration.masks.recovery_limit
+          limit = Throttle.limit(:recovery)
 
           recent.where("payload->>'address' = ?", address).count >= limit ||
             (ip.present? && recent.where("payload->>'ip' = ?", ip).count >= limit * INBOX_PER_IP)
@@ -40,7 +40,7 @@ module Masks
         def crowded?(actor:, channel:)
           where(actor_id: actor.id, created_at: WINDOW.ago..)
             .where("payload->>'channel' = ?", channel)
-            .count >= ::Rails.configuration.masks.recovery_limit
+            .count >= Throttle.limit(:recovery)
         end
 
         def inbox