masks-server 0.11.0 → 0.13.0

data/app/models/masks/server/health.rb

@@ -0,0 +1,310 @@
+require "net/smtp"
+
+module Masks
+  module Server
+    module Health
+      Result = Struct.new(:name, :status, :summary, :details) do
+        def failing?
+          status == HealthCheck::FAILING
+        end
+      end
+
+      SERVER = %w[jobs worker queue ldap metrics].freeze
+      TENANT = %w[mail origin domains keys proxy].freeze
+      NAMES = (SERVER + TENANT).freeze
+
+      FAILING_KEY = "masks:health:failing".freeze
+      ORIGIN_PREFIX = "masks:health:origin:".freeze
+      PROXY_KEY = "masks:health:proxy".freeze
+      PROXY_ADDRESSES = 5
+      PROXY_LOG = {
+        "untrusted" => "proxy: forwarded headers arrived from %{address}, which MASKS_TRUSTED_PROXIES does not list, so they were ignored",
+        "plain" => "proxy: %{address} forwards requests as plain http; have it send X-Forwarded-Proto: https"
+      }.freeze
+      ONE_ADDRESS_FLOOR = 20
+      LOOPBACK = /\A(?:(?:.+\.)?localhost|127(?:\.\d{1,3}){3}|\[::1\])\z/i
+      KEEP = 1.day
+      NOTE_EVERY = 10.minutes
+      SMTP_TIMEOUT = 5
+      TOKEN_LENGTH = 24
+
+      SMTP_ERRORS = [
+        Net::SMTPError, IOError, SystemCallError, SocketError, Timeout::Error, OpenSSL::SSL::SSLError
+      ].freeze
+
+      module_function
+
+      def check!(tenant = Current.tenant)
+        rows = store!(server_results + tenant_results)
+        remember!(tenant, rows)
+        rows
+      end
+
+      def server_results
+        [ jobs_result, worker_result, queue_result, ldap_result, metrics_result ]
+      end
+
+      def tenant_results
+        [ mail_result, origin_result, domains_result, keys_result, proxy_result ]
+      end
+
+      def store!(results)
+        now = Time.current
+
+        results.map do |result|
+          row = HealthCheck.find_or_initialize_by(name: result.name)
+          was = row.status
+
+          row.assign_attributes(status: result.status, summary: result.summary, details: result.details, checked_at: now)
+          row.changed_at = now if was != result.status
+          row.save!
+
+          announce(row, was)
+
+          row
+        end
+      end
+
+      def announce(row, was)
+        if row.failing? && was != HealthCheck::FAILING
+          Event.record!(Event::HEALTH_FAILING, by: nil, check: row.name, summary: row.summary)
+        elsif row.ok? && was == HealthCheck::FAILING
+          Event.record!(Event::HEALTH_RECOVERED, by: nil, check: row.name, summary: row.summary)
+        end
+      end
+
+      def remember!(tenant, rows)
+        held = (::Rails.cache.read(FAILING_KEY) || {}).transform_values { |subdomains| subdomains - [ tenant.subdomain ] }
+        rows.select(&:failing?).each { |row| (held[row.name] ||= []) << tenant.subdomain }
+
+        remember_all!(held)
+      end
+
+      def remember_all!(failing)
+        ::Rails.cache.write(FAILING_KEY, failing.reject { |_, subdomains| subdomains.empty? }, expires_in: KEEP)
+      end
+
+      def failing_named
+        (::Rails.cache.read(FAILING_KEY) || {}).sort.map do |name, subdomains|
+          SERVER.include?(name) ? name : "#{name} (#{subdomains.sort.join(', ')})"
+        end
+      end
+
+      def jobs_result
+        return ok("jobs", "elsewhere") unless Queue.run?
+
+        failed = Queue.failing_jobs
+
+        return ok("jobs", "none") if failed.empty?
+
+        failing("jobs", "failed", count: failed.size, jobs: failed.map(&:demodulize))
+      end
+
+      def worker_result
+        return ok("worker", "elsewhere") unless Queue.run?
+        return ok("worker", "unchecked") unless Queue.silence.positive?
+        return failing("worker", "silent", minutes: Queue.silence.to_i / 60) if Queue.worker_silent?
+
+        ok("worker", "reporting")
+      end
+
+      def queue_result
+        return ok("queue", "elsewhere") unless Queue.run?
+        return ok("queue", "unchecked") unless Queue.wait.positive?
+
+        stuck = Queue.stuck_since
+
+        return failing("queue", "stuck", since: stuck.utc.iso8601, minutes: Queue.wait.to_i / 60) if stuck
+
+        ok("queue", "moving")
+      end
+
+      def ldap_result
+        settings = ::Rails.configuration.masks
+
+        return ok("ldap", "tls") if settings.ldap_cert.present?
+        return ok("ldap", "local") unless settings.ldap_plaintext
+
+        warning("ldap", "plain", port: settings.ldap_port)
+      end
+
+      def metrics_result
+        token = ENV["MASKS_METRICS_TOKEN"]
+
+        return ok("metrics", "off") if token.blank?
+        return warning("metrics", "short", length: token.length, needed: TOKEN_LENGTH) if token.length < TOKEN_LENGTH
+
+        ok("metrics", "on")
+      end
+
+      def mail_result
+        settings = smtp_settings
+
+        return ok("mail", "none") if settings.nil?
+
+        return failing("mail", "silent", error: Senders::Smtp::UNREACHABLE) if settings.delete(:vetted) && !public_smtp?(settings)
+
+        error = smtp_problem(settings)
+
+        error ? failing("mail", "silent", error: error) : ok("mail", "answers")
+      end
+
+      def smtp_settings
+        sender = Sender.primary(Sender::MAIL)
+
+        if sender.is_a?(Senders::Smtp)
+          { address: sender[:address], port: sender[:port].to_i, tls: sender[:tls] == true, domain: sender[:domain], vetted: true }
+        elsif (held = ::Rails.configuration.masks.smtp_settings)
+          { address: held[:address], port: held[:port].to_i, tls: held[:tls] == true, domain: held[:domain] }
+        end
+      end
+
+      def public_smtp?(settings)
+        ::Rails.env.local? || Outbound.public_address(settings[:address], settings[:port]).present?
+      end
+
+      def smtp_problem(settings)
+        smtp = Net::SMTP.new(settings[:address], settings[:port])
+        smtp.open_timeout = SMTP_TIMEOUT
+        smtp.read_timeout = SMTP_TIMEOUT
+        settings[:tls] ? smtp.enable_tls : smtp.enable_starttls_auto
+
+        smtp.start(settings[:domain].presence || "localhost") { nil }
+
+        nil
+      rescue *SMTP_ERRORS => error
+        error.class.name
+      end
+
+      def origin_result
+        return ok("origin", "unset") if Current.tenant&.public_origin.nil?
+
+        noted = ::Rails.cache.read(origin_key(Current.tenant))
+
+        return ok("origin", "matches") if noted.nil?
+
+        warning("origin", "mismatch", seen: noted["seen"], origin: noted["origin"])
+      end
+
+      def note_origin!(tenant, seen, origin)
+        return if seen.nil? || origin.nil? || seen.casecmp?(origin)
+
+        now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        last = noted[tenant.id]
+
+        return if last && now - last < NOTE_EVERY
+
+        noted[tenant.id] = now
+        ::Rails.cache.write(origin_key(tenant), { "seen" => seen, "origin" => origin }, expires_in: KEEP)
+      end
+
+      def forget_origin!(tenant)
+        noted.delete(tenant.id)
+        ::Rails.cache.delete(origin_key(tenant))
+      end
+
+      def noted
+        @noted ||= Concurrent::Map.new
+      end
+
+      def origin_key(tenant)
+        "#{ORIGIN_PREFIX}#{tenant.id}"
+      end
+
+      def note_proxy!(kind, address)
+        return if address.blank? || !PROXY_LOG.key?(kind)
+
+        now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        key = "proxy:#{kind}:#{address}"
+        last = noted[key]
+
+        return if last && now - last < NOTE_EVERY
+
+        noted[key] = now
+        ::Rails.logger.warn(format(PROXY_LOG.fetch(kind), address: address))
+
+        held = ::Rails.cache.read(PROXY_KEY) || {}
+        seen = (held[kind] ||= {})
+        seen[address] = Time.current.utc.iso8601 if seen.key?(address) || seen.size < PROXY_ADDRESSES
+        ::Rails.cache.write(PROXY_KEY, held, expires_in: KEEP)
+      end
+
+      def forget_proxy!
+        noted.keys.grep(/\Aproxy:/).each { |key| noted.delete(key) }
+        ::Rails.cache.delete(PROXY_KEY)
+      end
+
+      def proxy_result
+        held = ::Rails.cache.read(PROXY_KEY) || {}
+        untrusted = held["untrusted"].to_h.keys.sort
+        plain = held["plain"].to_h.keys.sort
+
+        return warning("proxy", "untrusted", addresses: untrusted) if untrusted.any?
+        return warning("proxy", "plain", addresses: plain) if plain.any?
+
+        address, count = sole_private_address
+
+        return warning("proxy", "one", address: address, count: count) if address
+
+        ok("proxy", "quiet")
+      end
+
+      def sole_private_address
+        origin = Current.tenant&.public_origin
+
+        return if origin.nil? || URI.parse(origin).host.to_s.match?(LOOPBACK)
+
+        recent = Event.where(created_at: 1.hour.ago..).where.not(ip_address: [ nil, "" ])
+        addresses = recent.distinct.limit(2).pluck(:ip_address)
+
+        return unless addresses.size == 1
+
+        count = recent.count
+
+        return if count < ONE_ADDRESS_FLOOR
+
+        address = IPAddr.new(addresses.first)
+
+        [ addresses.first, count ] if address.private? || address.loopback? || address.link_local?
+      rescue IPAddr::InvalidAddressError, URI::InvalidURIError
+        nil
+      end
+
+      def domains_result
+        return ok("domains", "none") unless DomainClaim.exists?
+
+        missing = DomainClaim.where.not(missing_since: nil).order(:domain).pluck(:domain)
+
+        return ok("domains", "proven") if missing.empty?
+
+        warning("domains", "missing", domains: missing)
+      end
+
+      def keys_result
+        active = SigningKey.active.first
+
+        return failing("keys", "missing") if active.nil?
+
+        days = ((Time.current - active.activated_at) / 1.day).floor
+        period = Current.tenant.key_rotation_days
+
+        return warning("keys", "manual", days: days) if period.nil?
+        return warning("keys", "stale", days: days, period: period) if days > period
+
+        ok("keys", "fresh", days: days, period: period)
+      end
+
+      def ok(name, summary, **details)
+        Result.new(name, HealthCheck::OK, summary, details.stringify_keys)
+      end
+
+      def warning(name, summary, **details)
+        Result.new(name, HealthCheck::WARNING, summary, details.stringify_keys)
+      end
+
+      def failing(name, summary, **details)
+        Result.new(name, HealthCheck::FAILING, summary, details.stringify_keys)
+      end
+    end
+  end
+end

data/app/models/masks/server/health_check.rb

@@ -0,0 +1,27 @@
+module Masks
+  module Server
+    class HealthCheck < ApplicationRecord
+      include TenantScoped
+
+      OK = "ok".freeze
+      WARNING = "warning".freeze
+      FAILING = "failing".freeze
+      STATUSES = [ OK, WARNING, FAILING ].freeze
+
+      validates :name, presence: true, uniqueness: { scope: :tenant_id }
+      validates :status, inclusion: { in: STATUSES }
+      validates :summary, presence: true
+
+      scope :failing, -> { where(status: FAILING) }
+      scope :by_name, -> { order(:name) }
+
+      def ok?
+        status == OK
+      end
+
+      def failing?
+        status == FAILING
+      end
+    end
+  end
+end

data/app/models/masks/server/invitation.rb

@@ -7,8 +7,8 @@ module Masks
 
       path "invite"
 
-      def self.lifetime
-        ::Rails.configuration.masks.invitation_lifetime
+      def self.lifetime(tenant = Current.tenant)
+        Tenant.link_lifetime(:invitation_lifetime, tenant)
       end
 
       def self.open!(actor:, by: nil)

data/app/models/masks/server/ldap_credential.rb

@@ -7,12 +7,12 @@ module Masks
       class Refused < StandardError; end
 
       class << self
-        def issue!(label:, by:)
+        def issue!(label:, by:, client: nil)
           name = label.to_s.strip.downcase
           raise Refused, "a label is lowercase letters, digits, dots, dashes, and underscores" unless name.match?(LABEL)
           raise Refused, "a live LDAP credential is already labeled #{name}" if named(name)
 
-          mint!(payload: { "label" => name, "issued_by" => by&.uuid }.compact, expires_at: LIFETIME.from_now)
+          mint!(client: client, payload: { "label" => name, "issued_by" => by&.uuid }.compact, expires_at: LIFETIME.from_now)
         end
 
         def named(label)

data/app/models/masks/server/login.rb

@@ -30,6 +30,9 @@ module Masks
 
       SETTLED = "settled".freeze
       FIRST_FACTOR_BY = "first_factor_by".freeze
+      RELAXED = "relaxed".freeze
+      STEP_UP = "step_up".freeze
+      ASKED_FOR = 10.minutes
 
       def self.permitted_updates
         STATES.flat_map { |state| state.declared_updates }.uniq
@@ -256,7 +259,30 @@ module Masks
 
         wanted = request.respond_to?(:multi_factor?) && request.multi_factor?
 
-        wanted || (request.present? && policy.apps_require_second_factor) || state("risk-check").stepping_up?
+        wanted || (request.present? && policy.apps_require_second_factor) || state("risk-check").stepping_up? ||
+          asked?(STEP_UP)
+      end
+
+      def relaxed?
+        asked?(RELAXED) && !stepping_up? && !policy.second_factor_required
+      end
+
+      def skipped_second_factor?
+        relaxed? && actor.present? && actor.second_factor? && !touched?(:second_factor) && !amr.include?(Issuer::MULTI_FACTOR)
+      end
+
+      def relax!(now = Time.current)
+        store[RELAXED] = { "until" => (now + ASKED_FOR).to_i }
+      end
+
+      def step_up!(now = Time.current)
+        store[STEP_UP] = { "until" => (now + ASKED_FOR).to_i }
+      end
+
+      def asked?(key)
+        held = store[key]
+
+        held.is_a?(Hash) && held["until"].to_i > Time.current.to_i
       end
 
       def multi_factored?
@@ -268,7 +294,7 @@ module Masks
       def second_factored?
         return false if reauthenticating? || stale? || actor.nil? || stepping_up?
 
-        touched?(:second_factor) || signed_in? || remembered?(:second_factor)
+        touched?(:second_factor) || (signed_in? && !session.second_factor_skipped?) || remembered?(:second_factor)
       end
 
       def second_factor_pending?

data/app/models/masks/server/mail_previews.rb

@@ -29,6 +29,7 @@ module Masks
             acme = Organization.new(key: "acme", name: "Acme", roles: [ "billing" ])
             joining = Membership.new(organization: acme, actor: person, role: "billing", invited_by: manager,
                                      invited_as: person.email, pending: true)
+            asked = AccessRequest.new(actor: person, client: client || Client.new(name: "Grafana"), label: "admins")
             promoted = Event.new(action: Event::MEMBERSHIP_ROLE_CHANGED, actor: person, by: manager, organization: acme,
                                  created_at: Time.current, details: { "was" => "member", "now" => "owner" })
 
@@ -51,6 +52,10 @@ module Masks
                 ActorMailer.organization_invitation(joining, journey: managing) ],
               [ "approved", "Account approved", managing,
                 ActorMailer.approved(person, journey: managing) ],
+              [ "access_granted", "Access granted", managing,
+                ActorMailer.access_granted(asked, journey: managing) ],
+              [ "access_declined", "Access declined", managing,
+                ActorMailer.access_declined(asked, journey: managing) ],
               [ "notification", "Security notice", system,
                 ActorMailer.notification(person, changed, journey: system) ],
               [ "notification_organization", "Organization role changed", system,

data/app/models/masks/server/mail_template.rb

@@ -13,6 +13,8 @@ module Masks
         "approval_requested" => %w[tenant nickname],
         "recovery_requested" => %w[tenant nickname],
         "approved" => %w[tenant name nickname],
+        "access_granted" => %w[tenant name nickname app],
+        "access_declined" => %w[tenant name nickname app],
         SIGNATURE => %w[tenant]
       }.freeze
       SUBJECT_LIMIT = 150

data/app/models/masks/server/membership.rb

@@ -18,8 +18,8 @@ module Masks
 
       before_create { self.invited_at ||= Time.current if pending? }
 
-      def self.lifetime
-        ::Rails.configuration.masks.organization_invitation_lifetime
+      def self.lifetime(tenant = Current.tenant)
+        Tenant.link_lifetime(:organization_invitation_lifetime, tenant)
       end
 
       normalizes :external_id, with: Actor::EXTERNAL_ID
@@ -29,13 +29,14 @@ module Masks
       validate :an_owner_remains, on: :update
 
       before_destroy :keep_an_owner
+      after_commit :settle_nested_groups
 
       def owner?
         role == Organization::OWNER && !pending?
       end
 
       def expires_at
-        invited_at + self.class.lifetime if pending?
+        invited_at + self.class.lifetime(tenant) if pending?
       end
 
       def expired?
@@ -72,6 +73,12 @@ module Masks
 
       private
 
+        def settle_nested_groups
+          return if organization.nil? || actor.nil?
+
+          Group.nested_under_organization(organization.key).find_each { |group| group.settle!(actor) }
+        end
+
         def role_is_offered
           errors.add(:role, "is not one #{organization&.name} offers") unless organization&.role?(role)
         end

data/app/models/masks/server/notifications.rb

@@ -18,7 +18,9 @@ module Masks
           Event::TEXT_CODES_ENABLED,
           Event::TEXT_CODES_DISABLED,
           Event::RECOVERY_REQUESTED,
-          Event::SECOND_FACTORS_RESET
+          Event::SECOND_FACTORS_RESET,
+          Event::APP_PASSWORD_CREATED,
+          Event::APP_PASSWORD_REVOKED
         ],
         "sessions" => [
           Event::SESSION_STARTED,

data/app/models/masks/server/password_reset.rb

@@ -5,8 +5,8 @@ module Masks
 
       path "reset"
 
-      def self.lifetime
-        ::Rails.configuration.masks.password_reset_lifetime
+      def self.lifetime(tenant = Current.tenant)
+        Tenant.link_lifetime(:password_reset_lifetime, tenant)
       end
 
       def self.settle!(secret, password)

data/app/models/masks/server/provider.rb

@@ -42,6 +42,7 @@ module Masks
       encrypts :private_key
 
       has_many :connections, dependent: :destroy
+      has_many :groups, dependent: :nullify
       has_many :delegations, through: :connections
 
       belongs_to :organization, optional: true

data/app/models/masks/server/queue.rb

@@ -0,0 +1,60 @@
+module Masks
+  module Server
+    module Queue
+      module_function
+
+      def run?
+        ::Rails.application.config.active_job.queue_adapter == :solid_queue
+      end
+
+      def silence
+        ::Rails.configuration.masks.worker_silence
+      end
+
+      def wait
+        ::Rails.configuration.masks.queue_wait
+      end
+
+      def failing_jobs
+        ::SolidQueue::FailedExecution.where(created_at: 1.day.ago..).joins(:job)
+                                     .distinct.pluck("solid_queue_jobs.class_name").sort
+      end
+
+      def worker_heartbeat_at
+        ::SolidQueue::Process.where(kind: "Worker").maximum(:last_heartbeat_at)
+      end
+
+      def oldest_waiting_at
+        ::SolidQueue::ReadyExecution.minimum(:created_at)
+      end
+
+      def worker_silent?
+        return false unless run? && silence.positive?
+
+        heartbeat = worker_heartbeat_at
+
+        heartbeat.nil? || heartbeat < silence.ago
+      end
+
+      def stuck_since
+        return nil unless run? && wait.positive?
+
+        oldest = oldest_waiting_at
+
+        oldest if oldest && oldest < wait.ago
+      end
+
+      def plain(duration)
+        ActiveSupport::Duration.build(duration.to_i).inspect
+      end
+
+      def worker_problem
+        return "no worker has reported in the last #{plain(silence)}" if worker_silent?
+
+        stuck = stuck_since
+
+        "a job has waited since #{stuck.utc.iso8601}, longer than #{plain(wait)}" if stuck
+      end
+    end
+  end
+end

data/app/models/masks/server/release.rb

@@ -0,0 +1,74 @@
+module Masks
+  module Server
+    module Release
+      URL = "https://api.github.com/repos/masksrb/masks/releases?per_page=20".freeze
+      KEY = "masks:release".freeze
+      KEEP = 3.days
+      TAG = /\Aserver-v(\d+\.\d+\.\d+)\z/
+      OPERATOR = /^\s*Operator:/i
+      TIMEOUT = 5
+      CEILING = 1.megabyte
+      UNREADABLE = [ Outbound::Refused, JSON::ParserError, TypeError, NoMethodError ].freeze
+
+      module_function
+
+      def check!
+        found = fetch
+
+        return nil if found.nil?
+
+        was = latest
+        remember!(found)
+
+        found if newer?(found["version"]) && was&.dig("version") != found["version"]
+      end
+
+      def fetch
+        headers = { "Accept" => "application/vnd.github+json", "User-Agent" => "masks-server/#{VERSION}" }
+        body = Outbound.get!(URI(URL), open: TIMEOUT, read: TIMEOUT, within: TIMEOUT, ceiling: CEILING, headers: headers).body
+
+        JSON.parse(body).each do |release|
+          version = release["tag_name"].to_s[TAG, 1]
+
+          next if version.nil? || release["draft"] || release["prerelease"]
+
+          return {
+            "version" => version,
+            "url" => release["html_url"].to_s,
+            "operator_step" => release["body"].to_s.match?(OPERATOR),
+            "checked_at" => Time.current.utc.iso8601
+          }
+        end
+
+        nil
+      rescue *UNREADABLE => error
+        ::Rails.logger.warn("the release check could not read the releases: #{error.class}")
+        nil
+      end
+
+      def remember!(found)
+        ::Rails.cache.write(KEY, found, expires_in: KEEP)
+      end
+
+      def forget!
+        ::Rails.cache.delete(KEY)
+      end
+
+      def latest
+        ::Rails.cache.read(KEY)
+      end
+
+      def available
+        found = latest
+
+        found if found && newer?(found["version"])
+      end
+
+      def newer?(version)
+        Gem::Version.new(version) > Gem::Version.new(VERSION)
+      rescue ArgumentError
+        false
+      end
+    end
+  end
+end

data/app/models/masks/server/saml_identity/farewells.rb

@@ -11,6 +11,7 @@ module Masks
           held = ::Rails.cache.read(key)
 
           return nil unless held.is_a?(Hash) && held["client_id"] == client.client_id
+          return nil unless Replay.first?("saml-farewell", request_id, within: client.id, expires_in: WAIT)
 
           ::Rails.cache.delete(key)
           new(held["steps"], held["finish"])

data/app/models/masks/server/session.rb

@@ -118,6 +118,14 @@ module Masks
         true
       end
 
+      def multi_factored?
+        Array(amr).include?(Issuer::MULTI_FACTOR) || !actor.second_factor?
+      end
+
+      def complete?
+        !second_factor_skipped?
+      end
+
       def fresh?
         authenticated_at.present? && authenticated_at > FRESHNESS.ago
       end