masks-server 0.11.0 → 0.13.0

data/app/models/masks/server/connection.rb

@@ -20,6 +20,8 @@ module Masks
 
       scope :live, -> { where(revoked_at: nil) }
 
+      after_commit :settle_sourced_groups, if: -> { saved_changes.keys.intersect?(%w[upstream_groups revoked_at actor_id]) }
+
       class << self
         def record!(provider:, actor:, identity:)
           subject = identity["sub"].presence ||
@@ -40,6 +42,7 @@ module Masks
       end
 
       def absorb_identity(identity)
+        self.upstream_groups = Array(identity[Provider::GROUPS]).map(&:to_s).compact_blank.uniq
         held = identity["email"].to_s.strip.downcase.presence
 
         return self if held.nil?
@@ -125,6 +128,10 @@ module Masks
 
       private
 
+        def settle_sourced_groups
+          Group.filled_by(provider).find_each { |group| group.settle!(actor) }
+        end
+
         def store_tokens!(tokens, **attributes)
           update!(access_token: tokens["access_token"], access_token_expires_at: expiry_from(tokens),
                   tokens_refreshed_at: Time.current, **attributes)

data/app/models/masks/server/declared.rb

@@ -3,7 +3,8 @@ module Masks
     class Declared
       class Invalid < StandardError; end
 
-      TENANT_KEYS = %w[name accent_color groups apps].freeze
+      TENANT_SETTINGS = (%w[name accent_color] + Tenant::LINK_LIFETIMES.keys.map(&:to_s)).freeze
+      TENANT_KEYS = (TENANT_SETTINGS + %w[groups apps]).freeze
       APP_KEYS = %w[preset url slug name client_id client_secret_env redirect_uris scopes allowed_groups
                     access_token_lifetime refresh_token_lifetime refresh_token_absolute_lifetime].freeze
 
@@ -20,7 +21,7 @@ module Masks
       def initialize(document)
         raise Invalid, "the declared configuration must be a mapping" unless document.is_a?(Hash)
 
-        @document = document
+        @document = document.except("limits")
       end
 
       def apply!
@@ -32,6 +33,8 @@ module Masks
       private
 
         def tenants
+          return [] if @document.empty?
+
           if @document.key?("tenants")
             @document.fetch("tenants").map do |subdomain, declared|
               [ Tenant.active.find_by(subdomain: subdomain) || raise(Invalid, "no tenant called #{subdomain}"), declared || {} ]
@@ -47,12 +50,19 @@ module Masks
         def apply_tenant(tenant, declared)
           known!(declared, TENANT_KEYS, tenant.subdomain)
 
-          tenant.update!(declared.slice("name", "accent_color").compact) if declared.key?("name") || declared.key?("accent_color")
+          settings = declared.slice(*TENANT_SETTINGS).compact
+          apply_settings(tenant, settings) if settings.any?
 
           Array(declared["groups"]).each { |key, group| apply_group(key, group || {}) }
           Array(declared["apps"]).filter_map { |key, app| apply_app(tenant, key, app || {}) }
         end
 
+        def apply_settings(tenant, settings)
+          tenant.update!(settings)
+        rescue ActiveRecord::RecordInvalid => e
+          raise Invalid, "#{tenant.subdomain}: #{e.record.errors.full_messages.to_sentence}"
+        end
+
         def apply_group(key, declared)
           group = Group.find_or_initialize_by(key: key)
           group.update!(name: declared["name"] || group.name || key.to_s.humanize)

data/app/models/masks/server/email_verification.rb

@@ -5,8 +5,8 @@ module Masks
 
       path "verify"
 
-      def self.lifetime
-        ::Rails.configuration.masks.email_verification_lifetime
+      def self.lifetime(tenant = Current.tenant)
+        Tenant.link_lifetime(:email_verification_lifetime, tenant)
       end
 
       def self.settle!(secret)

data/app/models/masks/server/event.rb

@@ -14,7 +14,7 @@ module Masks
       SESSION_EXPIRED = "session.expired".freeze
       LOGOUT_UNDELIVERED = "logout.undelivered".freeze
       LOGIN_REFUSED = "login.refused".freeze
-      LOGIN_THROTTLED = "login.throttled".freeze
+      LIMIT_REACHED = "limit.reached".freeze
 
       ACCOUNT_CREATED = "account.created".freeze
       ACCOUNT_EXPORTED = "account.exported".freeze
@@ -54,6 +54,10 @@ module Masks
       GROUP_DELETED = "group.deleted".freeze
       GROUP_JOINED = "group.member_added".freeze
       GROUP_LEFT = "group.member_removed".freeze
+      ACCESS_REQUESTED = "access.requested".freeze
+      ACCESS_GRANTED = "access.granted".freeze
+      ACCESS_DECLINED = "access.declined".freeze
+      GROUP_REFRESHED = "group.refreshed".freeze
 
       DEVICE_CODE_ISSUED = "device_code.issued".freeze
       DEVICE_CODE_APPROVED = "device_code.approved".freeze
@@ -98,6 +102,9 @@ module Masks
       LDAP_CREDENTIAL_ISSUED = "ldap_credential.issued".freeze
       LDAP_CREDENTIAL_REVOKED = "ldap_credential.revoked".freeze
       LDAP_BOUND = "ldap.bound".freeze
+      APP_PASSWORD_CREATED = "app_password.created".freeze
+      APP_PASSWORD_USED = "app_password.used".freeze
+      APP_PASSWORD_REVOKED = "app_password.revoked".freeze
 
       CLIENT_CREATED = "client.created".freeze
       CLIENT_REGISTERED = "client.registered".freeze
@@ -169,12 +176,15 @@ module Masks
       CUSTOM_DOMAIN_STOPPED = "custom_domain.stopped".freeze
 
       JOB_FAILED = "job.failed".freeze
+      HEALTH_FAILING = "health.failing".freeze
+      HEALTH_RECOVERED = "health.recovered".freeze
+      RELEASE_AVAILABLE = "release.available".freeze
 
       GRAVE = [
-        LOGIN_REFUSED, LOGIN_THROTTLED, LOGOUT_UNDELIVERED, REFRESH_REUSED, STREAM_FAILED,
+        LOGIN_REFUSED, LIMIT_REACHED, LOGOUT_UNDELIVERED, REFRESH_REUSED, STREAM_FAILED,
         DEVICE_BLOCKED, ACTOR_DELETED, AUTHENTICATOR_DISABLED, CONNECTION_REFUSED, DELEGATION_REFUSED,
         EXCHANGE_REFUSED, SIGN_IN_RISKY, SIGNAL_UNDELIVERED, TEXT_UNDELIVERED, SIGNAL_RECEIVED, MEMBERSHIP_ROLE_KEPT,
-        ORGANIZATION_OWNERLESS, JOB_FAILED
+        ORGANIZATION_OWNERLESS, JOB_FAILED, HEALTH_FAILING
       ].freeze
 
       ACTIONS = constants(false).filter_map do |name|

data/app/models/masks/server/federation/protocol.rb

@@ -86,7 +86,7 @@ module Masks
             end
 
             held["sub"] = dig(raw, map["sub"])&.to_s.presence
-            held[Provider::GROUPS] = Array(groups(raw)).map(&:to_s).presence if provider.organization_id
+            held[Provider::GROUPS] = Array(groups(raw)).map(&:to_s).presence
             held.compact
           end
 

data/app/models/masks/server/federation/saml.rb

@@ -104,7 +104,7 @@ module Masks
 
             held["sub"] = map["sub"] == NAME_ID ? response.name_id.to_s.presence : attribute(attributes, map["sub"])&.to_s.presence
             held["email"] = held["email"].to_s.strip.downcase.presence
-            held[Provider::GROUPS] = Array(attributes.multi(provider.group_claim)).map(&:to_s).presence if provider.organization_id
+            held[Provider::GROUPS] = Array(attributes.multi(provider.group_claim)).map(&:to_s).presence
 
             held.compact
           end

data/app/models/masks/server/forward_auth_rules.rb

@@ -0,0 +1,162 @@
+module Masks
+  module Server
+    class ForwardAuthRules
+      OPEN = "open".freeze
+      ONE_FACTOR = "one_factor".freeze
+      TWO_FACTOR = "two_factor".freeze
+      TOKEN = "token".freeze
+      DENY = "deny".freeze
+      OUTCOMES = [ OPEN, ONE_FACTOR, TWO_FACTOR, TOKEN, DENY ].freeze
+
+      SIGN_IN = "sign_in".freeze
+      DEFAULT = "default".freeze
+
+      METHODS = %w[GET HEAD POST PUT PATCH DELETE OPTIONS].freeze
+      LISTS = %w[paths methods networks groups].freeze
+      FIELDS = (LISTS + [ "outcome" ]).freeze
+      MOST_RULES = 50
+      MOST_ENTRIES = 20
+      PATH = %r{\A/[^\s?#]{0,511}\z}
+
+      Decision = Struct.new(:outcome, :rule, :index)
+
+      class Rule
+        attr_reader :paths, :methods, :networks, :groups, :outcome
+
+        def initialize(held)
+          @paths = Array(held["paths"])
+          @methods = Array(held["methods"])
+          @networks = Array(held["networks"]).filter_map { |range| ForwardAuthRules.network(range) }
+          @groups = Array(held["groups"])
+          @outcome = held["outcome"].to_s
+        end
+
+        def covers?(path, method, address)
+          covers_path?(path) && covers_method?(method) && covers_address?(address)
+        end
+
+        def gated?
+          groups.any?
+        end
+
+        def admits?(actor)
+          !gated? || actor.group_labels.intersect?(groups)
+        end
+
+        private
+
+          def covers_path?(path)
+            paths.empty? || patterns.any? { |pattern| pattern.match?(path) }
+          end
+
+          def covers_method?(method)
+            methods.empty? || methods.include?(method)
+          end
+
+          def covers_address?(address)
+            return true if networks.empty?
+
+            held = ForwardAuthRules.address(address)
+            held.present? && networks.any? { |network| network.include?(held) }
+          end
+
+          def patterns
+            @patterns ||= paths.map { |path| ForwardAuthRules.pattern(path) }
+          end
+      end
+
+      class << self
+        def normalize(value)
+          Array(value).map do |held|
+            next held unless held.is_a?(Hash)
+
+            held = held.to_h.transform_keys(&:to_s)
+            lists = LISTS.to_h { |list| [ list, Array(held[list]).map { |entry| entry.to_s.strip }.compact_blank.uniq ] }
+            lists["methods"] = lists["methods"].map(&:upcase)
+            lists["groups"] = lists["groups"].map(&:downcase)
+
+            held.except(*FIELDS).merge(lists, "outcome" => held["outcome"].to_s.strip.downcase)
+          end
+        end
+
+        def problems(rules)
+          return [ "forward auth rules must be a list of rules" ] unless rules.is_a?(Array)
+          return [ "forward auth rules hold more than #{MOST_RULES} rules" ] if rules.size > MOST_RULES
+
+          rules.flat_map.with_index(1) { |rule, position| problems_in(rule, position) }
+        end
+
+        def pattern(path)
+          source = path.split("**", -1).map { |piece| piece.split("*", -1).map { |held| Regexp.escape(held) }.join("[^/]*") }.join(".*")
+          source = "#{source.delete_suffix('/.*')}(/.*)?" if path.end_with?("/**")
+
+          /\A#{source}\z/
+        end
+
+        def network(range)
+          IPAddr.new(range.to_s)
+        rescue IPAddr::Error
+          nil
+        end
+
+        def address(value)
+          held = IPAddr.new(value.to_s.split("%").first.to_s)
+          held.ipv4_mapped? ? held.native : held
+        rescue IPAddr::Error
+          nil
+        end
+
+        def path(value)
+          decoded = URI::RFC2396_PARSER.unescape(value.to_s)
+          cleaned = Pathname.new(decoded.start_with?("/") ? decoded : "/#{decoded}").cleanpath.to_s
+
+          cleaned.start_with?("/") ? cleaned : "/"
+        end
+
+        private
+
+          def problems_in(rule, position)
+            named = "forward auth rule #{position}"
+            return [ "#{named} is not a set of fields" ] unless rule.is_a?(Hash)
+
+            unknown = rule.keys - FIELDS
+            return [ "#{named} names #{unknown.join(', ')}, which is not a field" ] if unknown.any?
+
+            [
+              ("#{named} has an outcome of #{rule['outcome'].inspect}, which is not one of #{OUTCOMES.join(', ')}" unless OUTCOMES.include?(rule["outcome"])),
+              *LISTS.map { |list| ("#{named} lists more than #{MOST_ENTRIES} #{list}" if rule[list].size > MOST_ENTRIES) },
+              *rule["paths"].grep_v(PATH).map { |path| "#{named} has a path of #{path.inspect}, which does not start with /" },
+              *(rule["methods"] - METHODS).map { |method| "#{named} names a method of #{method.inspect}, which is not one of #{METHODS.join(', ')}" },
+              *rule["networks"].reject { |range| network(range) }.map { |range| "#{named} has a network of #{range.inspect}, which is not an address or a range such as 192.168.0.0/16" },
+              *rule["groups"].grep_v(Client::ALLOWED_GROUP).map { |group| "#{named} names a group of #{group.inspect}, which is not a group key or key:role" }
+            ].compact
+          end
+      end
+
+      attr_reader :rules
+
+      def initialize(held)
+        @rules = Array(held).select { |rule| rule.is_a?(Hash) }.map { |rule| Rule.new(rule) }
+      end
+
+      def any?
+        rules.any?
+      end
+
+      def decide(path:, method:, address:, actor: nil)
+        cleaned = self.class.path(path)
+        verb = method.to_s.upcase.presence || "GET"
+
+        rules.each_with_index do |rule, index|
+          next unless rule.covers?(cleaned, verb, address)
+          return Decision.new(SIGN_IN, rule, index) if rule.gated? && actor.nil?
+          next unless rule.admits?(actor)
+
+          return Decision.new(rule.outcome, rule, index)
+        end
+
+        Decision.new(DEFAULT, nil, nil)
+      end
+    end
+  end
+end

data/app/models/masks/server/group.rb

@@ -3,29 +3,232 @@ module Masks
     class Group < ApplicationRecord
       include TenantScoped
 
+      class Sourced < StandardError; end
+
       KEY = /\A[a-z0-9][a-z0-9._-]*\z/
+      MANUAL = "manual".freeze
+      RULE = "rule".freeze
+      PROVIDER = "provider".freeze
+      NESTED = "group".freeze
+      SOURCES = [ MANUAL, RULE, PROVIDER, NESTED ].freeze
+      SOURCED = [ RULE, PROVIDER, NESTED ].freeze
+      SETTINGS = %w[source rule provider_id upstream_group parent_labels].freeze
+      WATCHED = (%w[email email_verified_at] + GroupRule::FIELDS).freeze
+      PARENTS = 10
+      LONGEST = 200
 
+      belongs_to :provider, optional: true
       has_many :members, class_name: "GroupMember", dependent: :delete_all
       has_many :actors, through: :members
 
+      scope :sourced, -> { where(source: SOURCED) }
+      scope :ruled, -> { where(source: RULE) }
+      scope :filled_by, ->(provider) { where(source: PROVIDER, provider_id: provider.id) }
+      scope :nested_under, ->(label) { where(source: NESTED).where("groups.parent_labels @> ?", [ label ].to_json) }
+      scope :nested_under_organization, lambda { |key|
+        where(source: NESTED).where(
+          "EXISTS (SELECT 1 FROM jsonb_array_elements_text(groups.parent_labels) AS label WHERE label LIKE ?)",
+          "#{sanitize_sql_like(key)}:%"
+        )
+      }
+
       normalizes :key, with: ->(value) { value.to_s.strip.downcase }
       normalizes :name, with: ->(value) { value.to_s.strip }
+      normalizes :source, with: ->(value) { value.to_s.strip.downcase.presence || MANUAL }
+      normalizes :rule, with: ->(value) { GroupRule.normalize(value) }
+      normalizes :upstream_group, with: ->(value) { value.to_s.strip.presence }
+      normalizes :parent_labels, with: ->(value) { Array(value).map { |label| label.to_s.strip.downcase }.compact_blank.uniq.sort }
 
       validates :key, presence: true, format: { with: KEY }, length: { maximum: 64 },
                       uniqueness: { scope: :tenant_id }
       validates :name, presence: true, length: { maximum: 100 }
+      validates :source, inclusion: { in: SOURCES }
+      validate :source_is_complete
+
+      after_commit :refresh_after_change, on: %i[create update], if: -> { saved_changes.keys.intersect?(SETTINGS) }
+      after_commit :refresh_children, on: :destroy
+
+      def sourced?
+        SOURCED.include?(source)
+      end
+
+      def children
+        Group.nested_under(key)
+      end
 
       def add!(actor, by: nil)
         member = members.find_or_create_by!(actor: actor)
-        Event.record!(Event::GROUP_JOINED, actor: actor, by: by, group: key) if member.previously_new_record?
+
+        if member.previously_new_record?
+          Event.record!(Event::GROUP_JOINED, actor: actor, by: by, group: key)
+          settle_children!(actor, by: by)
+        elsif member.sourced?
+          member.update!(sourced_by: nil)
+          Event.record!(Event::GROUP_JOINED, actor: actor, by: by, group: key, kept: true)
+        end
+
         member
       end
 
       def remove!(actor, by: nil)
-        removed = members.where(actor: actor).delete_all.positive?
-        Event.record!(Event::GROUP_LEFT, actor: actor, by: by, group: key) if removed
-        removed
+        member = members.find_by(actor: actor)
+
+        return false if member.nil?
+        raise Sourced, "#{actor.identifier} is in #{name} from its #{source}, so the #{source} decides" if member.sourced?
+
+        member.delete
+        Event.record!(Event::GROUP_LEFT, actor: actor, by: by, group: key)
+        settle_children!(actor, by: by)
+
+        true
       end
+
+      def refresh!(by: nil, seen: Set.new)
+        return self unless seen.add?(id)
+
+        wanted = sourced? ? wanted_actor_ids : []
+        held = members.where(sourced_by: source).pluck(:actor_id)
+        pinned = members.manual.pluck(:actor_id)
+        joining = wanted - held - pinned
+        leaving = (held - wanted) | members.sourced.where.not(sourced_by: source).pluck(:actor_id)
+
+        transaction do
+          members.sourced.where(actor_id: leaving).delete_all if leaving.any?
+          members.insert_all(joining.map { |actor_id| { actor_id: actor_id, tenant_id: tenant_id, sourced_by: source } }) if joining.any?
+          update_column(:refreshed_at, Time.current)
+        end
+
+        return self if joining.empty? && leaving.empty?
+
+        Event.record!(Event::GROUP_REFRESHED, by: by, group: key, source: source, added: joining.size, removed: leaving.size)
+        children.find_each { |child| child.refresh!(by: by, seen: seen) }
+
+        self
+      end
+
+      def settle!(actor, by: nil, seen: Set.new)
+        return unless seen.add?(id)
+
+        member = members.find_by(actor: actor)
+
+        return if member && !member.sourced?
+
+        if sourced? && wants?(actor)
+          return if member&.sourced_by == source
+
+          member ? member.update!(sourced_by: source) : members.create!(actor: actor, sourced_by: source)
+          Event.record!(Event::GROUP_JOINED, actor: actor, by: by, group: key, source: source) if member.nil?
+        elsif member
+          member.delete
+          Event.record!(Event::GROUP_LEFT, actor: actor, by: by, group: key, source: member.sourced_by)
+        else
+          return
+        end
+
+        children.find_each { |child| child.settle!(actor, by: by, seen: seen) }
+      end
+
+      def wants?(actor)
+        case source
+        when RULE then GroupRule.scope(rule).exists?(id: actor.id)
+        when PROVIDER then provider_connections.exists?(actor_id: actor.id)
+        when NESTED then parent_members.exists?(actor_id: actor.id) || parent_memberships.exists?(actor_id: actor.id)
+        else false
+        end
+      end
+
+      def parent_keys
+        parent_labels.grep_v(/:/)
+      end
+
+      private
+
+        def wanted_actor_ids
+          case source
+          when RULE then GroupRule.scope(rule).pluck(:id)
+          when PROVIDER then provider_connections.distinct.pluck(:actor_id)
+          when NESTED then parent_members.distinct.pluck(:actor_id) | parent_memberships.distinct.pluck(:actor_id)
+          else []
+          end
+        end
+
+        def provider_connections
+          return Connection.none if provider_id.nil?
+
+          Connection.live.where(provider_id: provider_id).where("connections.upstream_groups @> ?", [ upstream_group ].to_json)
+        end
+
+        def parent_members
+          GroupMember.joins(:group).where(groups: { key: parent_keys })
+        end
+
+        def parent_memberships
+          roles = parent_labels.grep(/:/).map { |label| label.split(":", 2) }
+
+          return Membership.none if roles.empty?
+
+          held = roles.map do |key, role|
+            Membership.sanitize_sql_array([ "(organizations.key = ? AND memberships.role = ?)", key, role ])
+          end
+
+          Membership.accepted.joins(:organization).merge(Organization.active).where(held.join(" OR "))
+        end
+
+        def settle_children!(actor, by:)
+          children.find_each { |child| child.settle!(actor, by: by) }
+        end
+
+        def refresh_after_change
+          refresh!
+        end
+
+        def refresh_children
+          children.find_each(&:refresh!)
+        end
+
+        def source_is_complete
+          case source
+          when RULE then GroupRule.problems(rule).each { |problem| errors.add(:rule, problem) }
+          when PROVIDER then provider_is_complete
+          when NESTED then parents_are_complete
+          end
+        end
+
+        def provider_is_complete
+          errors.add(:provider, "is needed to fill a group from one") if provider.nil?
+          errors.add(:upstream_group, "names the group at the provider") if upstream_group.blank? || upstream_group.length > LONGEST
+        end
+
+        def parents_are_complete
+          return errors.add(:parent_labels, "name at least one group or organization role") if parent_labels.empty?
+          return errors.add(:parent_labels, "name at most #{PARENTS}") if parent_labels.size > PARENTS
+
+          parent_labels.grep_v(Client::ALLOWED_GROUP).each do |label|
+            errors.add(:parent_labels, "has #{label}, which is not a group key or key:role")
+          end
+
+          (parent_keys - Group.where(key: parent_keys).pluck(:key)).each do |missing|
+            errors.add(:parent_labels, "name #{missing}, which is not a group")
+          end
+
+          errors.add(:parent_labels, "would put #{name} inside itself") if cycles?
+        end
+
+        def cycles?
+          pending = parent_keys.dup
+          seen = Set.new
+
+          until pending.empty?
+            held = pending.shift
+
+            return true if held == key
+            next unless seen.add?(held)
+
+            pending.concat(Array(Group.where(key: held, source: NESTED).pick(:parent_labels)).grep_v(/:/))
+          end
+
+          false
+        end
     end
   end
 end

data/app/models/masks/server/group_member.rb

@@ -5,6 +5,13 @@ module Masks
 
       belongs_to :group
       belongs_to :actor
+
+      scope :manual, -> { where(sourced_by: nil) }
+      scope :sourced, -> { where.not(sourced_by: nil) }
+
+      def sourced?
+        sourced_by.present?
+      end
     end
   end
 end

data/app/models/masks/server/group_rule.rb

@@ -0,0 +1,63 @@
+module Masks
+  module Server
+    module GroupRule
+      EMAIL_DOMAIN = "email_domain".freeze
+      PROFILE = "profile".freeze
+      KINDS = [ EMAIL_DOMAIN, PROFILE ].freeze
+      FIELDS = %w[name given_name family_name middle_name nickname gender zoneinfo locale].freeze
+      LIMIT = 5
+      DOMAIN = /\A[a-z0-9][a-z0-9.-]*\.[a-z]{2,}\z/
+      LONGEST = 200
+
+      class << self
+        def normalize(value)
+          Array(value).filter_map do |condition|
+            next unless condition.respond_to?(:to_h)
+
+            held = condition.to_h.to_h { |key, item| [ key.to_s, item.to_s.strip ] }
+            kind = held["kind"]
+            value = kind == EMAIL_DOMAIN ? held["value"].to_s.downcase.delete_prefix("@") : held["value"].to_s
+
+            { "kind" => kind, "field" => (held["field"] if kind == PROFILE), "value" => value }.compact
+          end
+        end
+
+        def problems(conditions)
+          return [ "a rule has at most #{LIMIT} conditions" ] if conditions.size > LIMIT
+          return [ "a rule needs at least one condition" ] if conditions.empty?
+
+          conditions.filter_map { |condition| problem(condition) }
+        end
+
+        def scope(conditions)
+          conditions.reduce(Actor.all) do |scope, condition|
+            case condition["kind"]
+            when EMAIL_DOMAIN
+              scope.where.not(email_verified_at: nil)
+                   .where("LOWER(actors.email) LIKE ?", "%@#{Actor.sanitize_sql_like(condition['value'])}")
+            when PROFILE
+              scope.merge(Actor.directed).where(condition["field"] => condition["value"])
+            else
+              scope.none
+            end
+          end
+        end
+
+        private
+
+          def problem(condition)
+            case condition["kind"]
+            when EMAIL_DOMAIN
+              "#{condition['value'].inspect} is not a domain" unless condition["value"].match?(DOMAIN)
+            when PROFILE
+              return "#{condition['field'].inspect} is not a profile field a rule can read" unless FIELDS.include?(condition["field"])
+
+              "a profile condition needs a value" if condition["value"].blank? || condition["value"].length > LONGEST
+            else
+              "#{condition['kind'].inspect} is not a kind of condition"
+            end
+          end
+      end
+    end
+  end
+end