masks-server 0.12.0 → 0.13.0

data/app/models/masks/server/health.rb

@@ -10,11 +10,19 @@ module Masks
       end
 
       SERVER = %w[jobs worker queue ldap metrics].freeze
-      TENANT = %w[mail origin domains keys].freeze
+      TENANT = %w[mail origin domains keys proxy].freeze
       NAMES = (SERVER + TENANT).freeze
 
       FAILING_KEY = "masks:health:failing".freeze
       ORIGIN_PREFIX = "masks:health:origin:".freeze
+      PROXY_KEY = "masks:health:proxy".freeze
+      PROXY_ADDRESSES = 5
+      PROXY_LOG = {
+        "untrusted" => "proxy: forwarded headers arrived from %{address}, which MASKS_TRUSTED_PROXIES does not list, so they were ignored",
+        "plain" => "proxy: %{address} forwards requests as plain http; have it send X-Forwarded-Proto: https"
+      }.freeze
+      ONE_ADDRESS_FLOOR = 20
+      LOOPBACK = /\A(?:(?:.+\.)?localhost|127(?:\.\d{1,3}){3}|\[::1\])\z/i
       KEEP = 1.day
       NOTE_EVERY = 10.minutes
       SMTP_TIMEOUT = 5
@@ -37,7 +45,7 @@ module Masks
       end
 
       def tenant_results
-        [ mail_result, origin_result, domains_result, keys_result ]
+        [ mail_result, origin_result, domains_result, keys_result, proxy_result ]
       end
 
       def store!(results)
@@ -203,6 +211,65 @@ module Masks
         "#{ORIGIN_PREFIX}#{tenant.id}"
       end
 
+      def note_proxy!(kind, address)
+        return if address.blank? || !PROXY_LOG.key?(kind)
+
+        now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        key = "proxy:#{kind}:#{address}"
+        last = noted[key]
+
+        return if last && now - last < NOTE_EVERY
+
+        noted[key] = now
+        ::Rails.logger.warn(format(PROXY_LOG.fetch(kind), address: address))
+
+        held = ::Rails.cache.read(PROXY_KEY) || {}
+        seen = (held[kind] ||= {})
+        seen[address] = Time.current.utc.iso8601 if seen.key?(address) || seen.size < PROXY_ADDRESSES
+        ::Rails.cache.write(PROXY_KEY, held, expires_in: KEEP)
+      end
+
+      def forget_proxy!
+        noted.keys.grep(/\Aproxy:/).each { |key| noted.delete(key) }
+        ::Rails.cache.delete(PROXY_KEY)
+      end
+
+      def proxy_result
+        held = ::Rails.cache.read(PROXY_KEY) || {}
+        untrusted = held["untrusted"].to_h.keys.sort
+        plain = held["plain"].to_h.keys.sort
+
+        return warning("proxy", "untrusted", addresses: untrusted) if untrusted.any?
+        return warning("proxy", "plain", addresses: plain) if plain.any?
+
+        address, count = sole_private_address
+
+        return warning("proxy", "one", address: address, count: count) if address
+
+        ok("proxy", "quiet")
+      end
+
+      def sole_private_address
+        origin = Current.tenant&.public_origin
+
+        return if origin.nil? || URI.parse(origin).host.to_s.match?(LOOPBACK)
+
+        recent = Event.where(created_at: 1.hour.ago..).where.not(ip_address: [ nil, "" ])
+        addresses = recent.distinct.limit(2).pluck(:ip_address)
+
+        return unless addresses.size == 1
+
+        count = recent.count
+
+        return if count < ONE_ADDRESS_FLOOR
+
+        address = IPAddr.new(addresses.first)
+
+        [ addresses.first, count ] if address.private? || address.loopback? || address.link_local?
+      rescue IPAddr::InvalidAddressError, URI::InvalidURIError
+        nil
+      end
+
       def domains_result
         return ok("domains", "none") unless DomainClaim.exists?
 
@@ -221,7 +288,7 @@ module Masks
         days = ((Time.current - active.activated_at) / 1.day).floor
         period = Current.tenant.key_rotation_days
 
-        return ok("keys", "manual", days: days) if period.nil?
+        return warning("keys", "manual", days: days) if period.nil?
         return warning("keys", "stale", days: days, period: period) if days > period
 
         ok("keys", "fresh", days: days, period: period)

data/app/models/masks/server/saml_identity/farewells.rb

@@ -11,6 +11,7 @@ module Masks
           held = ::Rails.cache.read(key)
 
           return nil unless held.is_a?(Hash) && held["client_id"] == client.client_id
+          return nil unless Replay.first?("saml-farewell", request_id, within: client.id, expires_in: WAIT)
 
           ::Rails.cache.delete(key)
           new(held["steps"], held["finish"])

data/app/models/masks/server/tenant.rb

@@ -31,6 +31,21 @@ module Masks
         end
       end
 
+      class Pooled < StandardError
+        def initialize(message = nil)
+          super(
+            message ||
+            "this server reaches Postgres through a pooler that hands out a different server " \
+            "connection for each transaction. The tenant masks sets on one connection is gone from " \
+            "the next, so a query would see no tenant's rows, or another tenant's. Connect masks to " \
+            "Postgres directly, or run the pooler in session mode."
+          )
+        end
+      end
+
+      POOL_PROBE = "masks.pool_probe".freeze
+      POOL_PROBE_ROUNDS = 3
+
       encrypts :pairwise_salt, :setup_token, key_provider: Server.tenant_key_provider
 
       attribute :uuid, default: -> { SecureRandom.uuid }
@@ -348,10 +363,28 @@ module Masks
 
           raise Exposed, held&.fetch("rolname", nil) unless held && held["bypasses"] == false
           raise Owner, held["rolname"] if held["owns"] && guards_ownership?
+          raise Pooled if pooled?
 
           @isolated = true
         end
 
+        def pooled?
+          return false if connection_pool.size < 2
+
+          POOL_PROBE_ROUNDS.times do
+            mine = SecureRandom.hex(8)
+            connection.exec_query("SELECT set_config($1, $2, false)", "probe", [ POOL_PROBE, mine ])
+
+            return false unless touched_another_connection?
+
+            return true unless connection.select_value("SELECT current_setting('#{POOL_PROBE}', true)") == mine
+          end
+
+          false
+        rescue ActiveRecord::ConnectionTimeoutError
+          false
+        end
+
         def role_privileges
           connection.select_one(<<~SQL)
             SELECT rolname, rolsuper OR rolbypassrls AS bypasses,
@@ -383,23 +416,34 @@ module Masks
         end
 
         def clear!
-          enter(nil)
+          enter(nil, for_transaction: false)
         end
 
         private
 
-          def enter(tenant)
+          def enter(tenant, for_transaction: connection.transaction_open?)
             Current.tenant = tenant
 
             connection.exec_query(
-              "SELECT set_config($1, $2, false)", "tenant",
-              [ TenantIsolation::SETTING, tenant&.id.to_s ]
+              "SELECT set_config($1, $2, $3)", "tenant",
+              [ TenantIsolation::SETTING, tenant&.id.to_s, for_transaction ]
             )
 
             connection.clear_query_cache
           rescue ActiveRecord::ConnectionNotEstablished, ActiveRecord::ConnectionFailed
             nil
           end
+
+          def touched_another_connection?
+            other = connection_pool.checkout
+
+            return false if other.equal?(connection)
+
+            other.exec_query("SELECT set_config($1, $2, false)", "probe", [ POOL_PROBE, "another connection" ])
+            true
+          ensure
+            connection_pool.checkin(other) if other
+          end
       end
 
       def signing_key

data/app/models/masks/server/throttle.rb

@@ -0,0 +1,165 @@
+module Masks
+  module Server
+    module Throttle
+      class Invalid < StandardError; end
+
+      Budget = Struct.new(:name, :to, :within, :about, :variable, keyword_init: true) do
+        def key
+          name.to_s
+        end
+
+        def limits
+          { to: to, within: within }
+        end
+
+        def reference
+          "| `#{variable}` | `#{key}` | #{to} in #{within.inspect} | #{about} |"
+        end
+      end
+
+      DEFAULTS = [
+        Budget.new(name: :attempt, to: 10, within: 3.minutes, variable: "MASKS_ATTEMPT_LIMIT",
+                   about: "Sign-in attempts from one IP address. Includes sign-in through a provider, failed LDAP binds, and app passwords."),
+        Budget.new(name: :account_attempt, to: 5, within: 3.minutes, variable: "MASKS_ACCOUNT_ATTEMPT_LIMIT",
+                   about: "Sign-in attempts against one account, from any IP address. Includes failed LDAP binds and app passwords. " \
+                          "Also how often a signed-in account changes its password, email address, or phone number, adds an " \
+                          "authenticator app, or approves a sign-in on another device."),
+        Budget.new(name: :recovery, to: 5, within: 15.minutes, variable: "MASKS_RECOVERY_LIMIT",
+                   about: "Codes and links sent by email or text message. Counted by IP address during sign-in, and by account for " \
+                          "every address or phone number a code goes to, including a phone added or changed during sign-in."),
+        Budget.new(name: :registration, to: 10, within: 10.minutes, variable: "MASKS_REGISTRATION_LIMIT",
+                   about: "Dynamic client registrations from one IP address, and new client metadata documents."),
+        Budget.new(name: :device_code, to: 30, within: 3.minutes, variable: "MASKS_DEVICE_CODE_LIMIT",
+                   about: "Device user codes entered from one IP address."),
+        Budget.new(name: :claim, to: 3, within: 1.hour, variable: "MASKS_CLAIM_LIMIT",
+                   about: "Tenants claimed from one IP address, when a subdomain template claims a tenant on its first visit. " \
+                          "Counted across the whole server."),
+        Budget.new(name: :claim_ceiling, to: 30, within: 1.hour, variable: "MASKS_CLAIM_CEILING",
+                   about: "Tenants claimed from all IP addresses together, under the same template. Counted across the whole server."),
+        Budget.new(name: :token, to: 60, within: 1.minute, variable: "MASKS_TOKEN_LIMIT", about: "Token requests from one IP address."),
+        Budget.new(name: :pushed_authorization, to: 60, within: 1.minute, variable: "MASKS_PUSHED_AUTHORIZATION_LIMIT", about: "Pushed authorization requests from one IP address."),
+        Budget.new(name: :device_authorization, to: 60, within: 1.minute, variable: "MASKS_DEVICE_AUTHORIZATION_LIMIT", about: "Device authorization requests from one IP address."),
+        Budget.new(name: :introspection, to: 120, within: 1.minute, variable: "MASKS_INTROSPECTION_LIMIT", about: "Token introspections from one IP address."),
+        Budget.new(name: :revocation, to: 120, within: 1.minute, variable: "MASKS_REVOCATION_LIMIT", about: "Token revocations from one IP address."),
+        Budget.new(name: :saml, to: 60, within: 1.minute, variable: "MASKS_SAML_LIMIT", about: "SAML sign-in and logout requests from one IP address."),
+        Budget.new(name: :forward_auth, to: 30, within: 1.minute, variable: "MASKS_FORWARD_AUTH_LIMIT", about: "Forward auth sign-ins started or finished from one IP address."),
+        Budget.new(name: :enrollment, to: 30, within: 1.minute, variable: "MASKS_ENROLLMENT_LIMIT", about: "Enrollment tokens redeemed from one IP address."),
+        Budget.new(name: :app_enrollment, to: 60, within: 1.hour, variable: "MASKS_APP_ENROLLMENT_LIMIT", about: "Enrollment tokens one app mints."),
+        Budget.new(name: :invitation, to: 30, within: 1.minute, variable: "MASKS_INVITATION_LIMIT", about: "Organization invitations one account sends or sends again."),
+        Budget.new(name: :export, to: 5, within: 1.hour, variable: "MASKS_EXPORT_LIMIT", about: "Account exports one account asks for."),
+        Budget.new(name: :access_request, to: 1, within: 1.hour, variable: "MASKS_ACCESS_REQUEST_LIMIT", about: "Times one account asks for access to one app."),
+        Budget.new(name: :signal, to: 600, within: 1.minute, variable: "MASKS_SIGNAL_LIMIT", about: "Security events received from one IP address."),
+        Budget.new(name: :scim, to: 600, within: 1.minute, variable: "MASKS_SCIM_LIMIT", about: "SCIM provisioning requests from one IP address.")
+      ].freeze
+
+      NAMES = DEFAULTS.map(&:key).freeze
+
+      module_function
+
+      def budgets
+        @budgets ||= DEFAULTS.to_h { |budget| [ budget.name, budget.dup.tap { |held| held.to = limit_for(budget) } ] }
+      end
+
+      def budget(name)
+        budgets.fetch(name.to_sym) { raise Invalid, "no limit is called #{name}. The limits are #{NAMES.join(', ')}." }
+      end
+
+      def limit(name)
+        budget(name).to
+      end
+
+      def limits(name)
+        budget(name).limits
+      end
+
+      def refused(name, &block)
+        held = budget(name)
+
+        proc { Throttle.hit!(held.name); instance_exec(&block) }
+      end
+
+      def key(name, by, scope: nil, named: nil)
+        held = budget(name)
+
+        [ "rate-limit", scope || "masks/server/#{held.key}", named, by ].compact.join(":")
+      end
+
+      def count!(name, by, scope: nil, named: nil)
+        ::Rails.cache.increment(key(name, by, scope: scope, named: named), 1, expires_in: budget(name).within)
+      end
+
+      def exceeded?(name, by, scope: nil, named: nil, times: 1)
+        ::Rails.cache.read(key(name, by, scope: scope, named: named)).to_i >= budget(name).to * times
+      end
+
+      def crowded?(name, by, scope: nil, named: nil, times: 1)
+        held = budget(name)
+
+        ::Rails.cache.increment(key(name, by, scope: scope, named: named), 1, expires_in: held.within).to_i > held.to * times
+      end
+
+      def hit!(name, actor: nil, client: nil, address: Current.ip_address, **details)
+        held = budget(name)
+
+        ::Rails.logger.info("masks: the #{held.key} limit of #{held.to} in #{held.within.inspect} was reached" \
+                            "#{address.present? ? " from #{address}" : ''}")
+
+        return if Current.tenant.nil?
+        return unless ::Rails.cache.write(key(name, "reached:#{address}"), true, unless_exist: true, expires_in: held.within)
+
+        Event.record!(Event::LIMIT_REACHED, actor: actor, by: nil, client: client, limit: held.key, **details)
+      end
+
+      def reference
+        DEFAULTS.map(&:reference)
+      end
+
+      def reset!
+        @budgets = nil
+        @declared = nil
+      end
+
+      def limit_for(budget)
+        from_env(budget) || declared.fetch(budget.key, nil) || budget.to
+      end
+
+      def from_env(budget)
+        value = ENV[budget.variable]
+
+        return nil if value.blank?
+
+        whole!(value, budget.variable)
+      end
+
+      def declared
+        @declared ||= read_declared(::Rails.configuration.masks.config_path)
+      end
+
+      def read_declared(path)
+        return {} if path.blank?
+
+        document = YAML.safe_load_file(path, aliases: false) || {}
+        limits = document.is_a?(Hash) ? document.fetch("limits", nil) || {} : {}
+
+        raise Invalid, "limits in #{path} must map each limit's name to a whole number" unless limits.is_a?(Hash)
+
+        unknown = limits.keys.map(&:to_s) - NAMES
+        raise Invalid, "#{path} sets limits called #{unknown.join(', ')}, which do not exist. The limits are #{NAMES.join(', ')}." if unknown.any?
+
+        limits.to_h { |name, value| [ name.to_s, whole!(value, "limits.#{name} in #{path}") ] }
+      rescue Errno::ENOENT, Psych::Exception
+        {}
+      end
+
+      def whole!(value, where)
+        count = Integer(value.to_s, 10)
+
+        raise Invalid, "#{where} is #{value.inspect}. A limit is a whole number, 1 or more." if count < 1
+
+        count
+      rescue ArgumentError, TypeError
+        raise Invalid, "#{where} is #{value.inspect}. A limit is a whole number, 1 or more."
+      end
+    end
+  end
+end

data/config/locales/de/manage/health.yml

@@ -65,13 +65,20 @@ de:
           proven: "Jede beanspruchte Domain hat noch ihren TXT-Eintrag."
           missing: "Der TXT-Eintrag fehlt für %{domains}. Ein Anspruch wird eine Woche nach dem Verschwinden seines Eintrags freigegeben."
           advice: "Legen Sie den TXT-Eintrag wieder unter dem Namen an, der auf der Seite Domains steht."
+        proxy:
+          title: "Reverse-Proxy"
+          quiet: "Weitergeleitete Header kommen nur von vertrauten Proxys, über HTTPS."
+          untrusted: "Weitergeleitete Header kamen von %{addresses}, das nicht in MASKS_TRUSTED_PROXIES steht, und wurden deshalb ignoriert. Alle Besucher hinter diesem Proxy teilen sich eine Adresse und ein Kontingent."
+          plain: "Der Proxy unter %{addresses} leitet Anfragen als einfaches HTTP weiter. masks markiert seine Cookies nur für HTTPS, also verwerfen Browser sie, und Anmeldungen laufen im Kreis."
+          one: "Alle %{count} Ereignisse der letzten Stunde kamen von %{address}, einer privaten Adresse, also höchstwahrscheinlich vom Proxy selbst."
+          advice: "Tragen Sie den Proxy in MASKS_TRUSTED_PROXIES ein und lassen Sie ihn X-Forwarded-For und X-Forwarded-Proto senden. Suchen Sie im Serverprotokoll nach Zeilen, die mit proxy: beginnen."
         keys:
           title: "Signaturschlüssel"
           missing: "Dieser Mandant hat keinen aktiven Signaturschlüssel, also kann nichts signiert werden."
-          manual: "Schlüssel werden von Hand rotiert. Der aktive Schlüssel ist %{days} Tage alt."
+          manual: "Schlüssel werden von Hand rotiert, also ersetzt nichts den aktiven Schlüssel von selbst. Er ist %{days} Tage alt."
           fresh: "Der aktive Schlüssel ist %{days} Tage alt und rotiert alle %{period} Tage."
           stale: "Der aktive Schlüssel ist %{days} Tage alt, älter als seine Rotation von %{period} Tagen."
-          advice: "Rotieren Sie den Schlüssel auf der Seite Einstellungen, oder lesen Sie den Job signing_keys im Serverprotokoll."
+          advice: "Wählen Sie auf der Seite Einstellungen einen Rotationsplan, rotieren Sie den Schlüssel dort, oder lesen Sie den Job signing_keys im Serverprotokoll."
       release:
         available: "Version %{version} ist verfügbar."
         operator: "Diese Version braucht einen Schritt von einem Betreiber. Lesen Sie ihre Hinweise vor dem Upgrade."

data/config/locales/en/manage/health.yml

@@ -65,13 +65,20 @@ en:
           proven: "Every claimed domain still has its TXT record."
           missing: "The TXT record is gone for %{domains}. A claim is released a week after its record disappears."
           advice: "Put the TXT record back at the name shown on the Domains page."
+        proxy:
+          title: "Reverse proxy"
+          quiet: "Forwarded headers come only from trusted proxies, over HTTPS."
+          untrusted: "Forwarded headers came from %{addresses}, which MASKS_TRUSTED_PROXIES does not list, so they were ignored. Every visitor behind that proxy shares one address and one set of rate limits."
+          plain: "The proxy at %{addresses} forwards requests as plain HTTP. masks marks its cookies for HTTPS only, so browsers drop them and sign-ins loop."
+          one: "All %{count} events in the last hour came from %{address}, a private address, which is most likely the proxy itself."
+          advice: "List the proxy in MASKS_TRUSTED_PROXIES and have it send X-Forwarded-For and X-Forwarded-Proto. Search the server log for lines that start with proxy:."
         keys:
           title: "Signing keys"
           missing: "This tenant has no active signing key, so nothing can be signed."
-          manual: "Keys rotate by hand. The active key is %{days} days old."
+          manual: "Keys rotate by hand, so nothing replaces the active key on its own. It is %{days} days old."
           fresh: "The active key is %{days} days old and rotates every %{period} days."
           stale: "The active key is %{days} days old, past its %{period} day rotation."
-          advice: "Rotate the key on the Settings page, or read the signing_keys job in the server log."
+          advice: "Pick a rotation schedule on the Settings page, rotate the key there, or read the signing_keys job in the server log."
       release:
         available: "Version %{version} is available."
         operator: "This release needs a step from an operator. Read its notes before you upgrade."

data/config/locales/es/manage/health.yml

@@ -65,13 +65,20 @@ es:
           proven: "Cada dominio reclamado conserva su registro TXT."
           missing: "Falta el registro TXT de %{domains}. Una reclamación se libera una semana después de que desaparezca su registro."
           advice: "Vuelve a poner el registro TXT en el nombre que muestra la página Dominios."
+        proxy:
+          title: "Proxy inverso"
+          quiet: "Las cabeceras reenviadas llegan solo desde proxies de confianza, por HTTPS."
+          untrusted: "Llegaron cabeceras reenviadas desde %{addresses}, que no figura en MASKS_TRUSTED_PROXIES, así que se ignoraron. Todos los visitantes detrás de ese proxy comparten una dirección y un mismo límite."
+          plain: "El proxy en %{addresses} reenvía las peticiones como HTTP sin cifrar. masks marca sus cookies solo para HTTPS, así que los navegadores las descartan y el inicio de sesión se repite en bucle."
+          one: "Los %{count} eventos de la última hora llegaron todos desde %{address}, una dirección privada, que casi seguro es el propio proxy."
+          advice: "Añade el proxy a MASKS_TRUSTED_PROXIES y haz que envíe X-Forwarded-For y X-Forwarded-Proto. Busca en el registro del servidor las líneas que empiezan por proxy:."
         keys:
           title: "Claves de firma"
           missing: "Este inquilino no tiene ninguna clave de firma activa, así que no se puede firmar nada."
-          manual: "Las claves se rotan a mano. La clave activa tiene %{days} días."
+          manual: "Las claves se rotan a mano, así que nada sustituye la clave activa por sí solo. Tiene %{days} días."
           fresh: "La clave activa tiene %{days} días y rota cada %{period} días."
           stale: "La clave activa tiene %{days} días, más que su rotación de %{period} días."
-          advice: "Rota la clave en la página Configuración, o lee la tarea signing_keys en el registro del servidor."
+          advice: "Elige un calendario de rotación en la página Configuración, rota la clave allí, o lee la tarea signing_keys en el registro del servidor."
       release:
         available: "La versión %{version} está disponible."
         operator: "Esta versión necesita un paso de un operador. Lee sus notas antes de actualizar."

data/config/locales/fr/manage/health.yml

@@ -65,13 +65,20 @@ fr:
           proven: "Chaque domaine revendiqué a toujours son enregistrement TXT."
           missing: "L'enregistrement TXT manque pour %{domains}. Une revendication est libérée une semaine après la disparition de son enregistrement."
           advice: "Remettez l'enregistrement TXT au nom indiqué sur la page Domaines."
+        proxy:
+          title: "Proxy inverse"
+          quiet: "Les en-têtes transmis ne viennent que de proxys de confiance, en HTTPS."
+          untrusted: "Des en-têtes transmis sont arrivés de %{addresses}, qui ne figure pas dans MASKS_TRUSTED_PROXIES, et ont donc été ignorés. Tous les visiteurs derrière ce proxy partagent une adresse et une même limite."
+          plain: "Le proxy à %{addresses} transmet les requêtes en HTTP non chiffré. masks réserve ses cookies au HTTPS, donc les navigateurs les rejettent et la connexion tourne en boucle."
+          one: "Les %{count} événements de la dernière heure viennent tous de %{address}, une adresse privée, qui est presque sûrement le proxy lui-même."
+          advice: "Ajoutez le proxy à MASKS_TRUSTED_PROXIES et faites-lui envoyer X-Forwarded-For et X-Forwarded-Proto. Cherchez dans le journal du serveur les lignes qui commencent par proxy:."
         keys:
           title: "Clés de signature"
           missing: "Ce locataire n'a aucune clé de signature active, donc rien ne peut être signé."
-          manual: "Les clés tournent à la main. La clé active a %{days} jours."
+          manual: "Les clés tournent à la main, donc rien ne remplace la clé active de lui-même. Elle a %{days} jours."
           fresh: "La clé active a %{days} jours et tourne tous les %{period} jours."
           stale: "La clé active a %{days} jours, au-delà de sa rotation de %{period} jours."
-          advice: "Faites tourner la clé sur la page Paramètres, ou lisez la tâche signing_keys dans le journal du serveur."
+          advice: "Choisissez un calendrier de rotation sur la page Paramètres, faites tourner la clé là, ou lisez la tâche signing_keys dans le journal du serveur."
       release:
         available: "La version %{version} est disponible."
         operator: "Cette version demande une étape d'un opérateur. Lisez ses notes avant de mettre à jour."

data/db/migrate/20261031100000_default_key_rotation_to_ninety_days.rb

@@ -0,0 +1,5 @@
+class DefaultKeyRotationToNinetyDays < ActiveRecord::Migration[8.1]
+  def change
+    change_column_default :tenants, :key_rotation_days, from: nil, to: 90
+  end
+end

data/lib/generators/masks/server/install/install_generator.rb

@@ -39,6 +39,7 @@ module Masks
           say ""
 
           engine? ? say_engine_database : say_server_database
+          say_cache_store if engine?
 
           say "In production, masks keeps the address its setup screen was first opened at, and builds the"
           say "issuer and every emailed link from it. To name the address yourself, set"
@@ -105,6 +106,24 @@ module Masks
             say ""
           end
 
+          def say_cache_store
+            say "masks holds one-time sign-in state, rate limits, and health findings in Rails.cache, so"
+            say "every process that serves it must share one cache store, such as :solid_cache_store,"
+            say ":redis_cache_store or :mem_cache_store. In production, masks refuses to boot on"
+            say ":memory_store or :null_store."
+
+            if Configuration.unshared_cache_store?(cache_store)
+              say ""
+              say "This app's cache_store is #{Array(cache_store).first.inspect}. Change it before you deploy.", :yellow
+            end
+
+            say ""
+          end
+
+          def cache_store
+            ::Rails.application&.config&.cache_store if defined?(::Rails.application)
+          end
+
           def say_server_database
             say "masks keeps its tables in the primary database. Connect as a role holding neither"
             say "SUPERUSER nor BYPASSRLS, and set config.active_record.schema_format = :sql, since"

data/lib/masks/server/configuration.rb

@@ -4,6 +4,7 @@ module Masks
   module Server
     module Configuration
       MODES = %i[server engine].freeze
+      UNSHARED_CACHE_STORES = %i[memory_store null_store].freeze
 
       module_function
 
@@ -12,13 +13,6 @@ module Masks
         config.mode = ENV.fetch("MASKS_MODE", "server").to_sym
         config.database = nil
         config.secret = nil
-        config.attempt_limit = ENV.fetch("MASKS_ATTEMPT_LIMIT", 10).to_i
-        config.account_attempt_limit = ENV.fetch("MASKS_ACCOUNT_ATTEMPT_LIMIT", 5).to_i
-        config.registration_limit = ENV.fetch("MASKS_REGISTRATION_LIMIT", 10).to_i
-        config.recovery_limit = ENV.fetch("MASKS_RECOVERY_LIMIT", 5).to_i
-        config.device_code_limit = ENV.fetch("MASKS_DEVICE_CODE_LIMIT", 30).to_i
-        config.claim_limit = ENV.fetch("MASKS_CLAIM_LIMIT", 3).to_i
-        config.claim_ceiling = ENV.fetch("MASKS_CLAIM_CEILING", 30).to_i
         config.setup_token = ENV["MASKS_SETUP_TOKEN"].presence
         config.recover = ENV["MASKS_RECOVER"].presence
         config.config_path = ENV["MASKS_CONFIG"].presence
@@ -88,7 +82,11 @@ module Masks
         }.compact
       end
 
-      def validate!(config, local:, building:)
+      def unshared_cache_store?(cache_store)
+        UNSHARED_CACHE_STORES.include?(Array(cache_store).first&.to_sym)
+      end
+
+      def validate!(config, local:, building:, cache_store: nil)
         unless MODES.include?(config.mode)
           raise "masks runs in server or engine mode, and config.masks.mode is #{config.mode.inspect}."
         end
@@ -131,6 +129,14 @@ module Masks
           raise "masks in engine mode needs a database of its own. Set config.masks.database to " \
                 "the name of a database.yml entry whose role cannot bypass row-level security."
         end
+
+        if unshared_cache_store?(cache_store)
+          raise "config.cache_store is #{Array(cache_store).first.inspect}, which every process keeps " \
+                "to itself. masks holds one-time sign-in state, rate limits, and health findings in " \
+                "Rails.cache, so a provider's callback redeemed in one process is lost in the next. " \
+                "Use a store every process shares, such as :solid_cache_store, :redis_cache_store " \
+                "or :mem_cache_store."
+        end
       end
     end
   end

data/lib/masks/server/engine.rb

@@ -20,7 +20,8 @@ module Masks
         Configuration.validate!(
           app.config.masks,
           local: ::Rails.env.local?,
-          building: ENV["SECRET_KEY_BASE_DUMMY"].present?
+          building: ENV["SECRET_KEY_BASE_DUMMY"].present?,
+          cache_store: app.config.cache_store
         )
 
         middleware.insert_before Tenancy::Middleware, Isolation if app.config.masks.mode == :engine

data/lib/masks/server/forwarding.rb

@@ -1,7 +1,11 @@
 module Masks
   module Server
     class Forwarding
-      HEADERS = %w[HTTP_X_FORWARDED_FOR HTTP_X_FORWARDED_HOST HTTP_CLIENT_IP HTTP_FORWARDED].freeze
+      HEADERS = %w[
+        HTTP_X_FORWARDED_FOR HTTP_X_FORWARDED_HOST HTTP_CLIENT_IP HTTP_FORWARDED
+        HTTP_X_FORWARDED_PROTO HTTP_X_FORWARDED_SCHEME HTTP_X_FORWARDED_SSL HTTP_X_FORWARDED_PORT
+      ].freeze
+      PROTO = "HTTP_X_FORWARDED_PROTO".freeze
 
       def initialize(app, proxies)
         @app = app
@@ -9,9 +13,20 @@ module Masks
       end
 
       def call(env)
-        HEADERS.each { |header| env.delete(header) } unless trusted?(env["REMOTE_ADDR"])
+        address = env["REMOTE_ADDR"]
+        trusted = trusted?(address)
 
-        @app.call(env)
+        unless trusted
+          Health.note_proxy!("untrusted", address) if HEADERS.any? { |header| env.key?(header) }
+          HEADERS.each { |header| env.delete(header) }
+        end
+
+        plain = trusted && plain?(env)
+        status, headers, body = @app.call(env)
+
+        Health.note_proxy!("plain", address) if plain && !sent_to_https?(status, headers)
+
+        [ status, headers, body ]
       end
 
       private
@@ -24,6 +39,14 @@ module Masks
         rescue IPAddr::InvalidAddressError, IPAddr::AddressFamilyError
           false
         end
+
+        def plain?(env)
+          env[PROTO].to_s.split(",").first.to_s.strip.casecmp?("http")
+        end
+
+        def sent_to_https?(status, headers)
+          (300..399).cover?(status) && headers["location"].to_s.downcase.start_with?("https://")
+        end
     end
   end
 end

data/lib/masks/server/tenancy/middleware.rb

@@ -6,7 +6,6 @@ module Masks
         MOVED = "masks answers at %s. To serve it at another address, set MASKS_PUBLIC_ORIGIN_TEMPLATE to that address.".freeze
         UNKEPT = "This tenant was set up without a kept address. Set MASKS_PUBLIC_ORIGIN_TEMPLATE to the address it answers at.".freeze
         CROWDED = "too many tenants were claimed recently; try again later".freeze
-        CLAIM_WINDOW = 1.hour
         TENANTLESS = %w[/up /metrics].freeze
         TLS_ASK = "/tls/allowed".freeze
 
@@ -94,18 +93,16 @@ module Masks
           end
 
           def crowded?(request)
-            window = Time.current.to_i / CLAIM_WINDOW.to_i
-            from_here = ::Rails.cache.increment("tenant-claims:#{window}:#{request.remote_ip}", 1, expires_in: CLAIM_WINDOW)
-            from_anywhere = ::Rails.cache.increment("tenant-claims:#{window}", 1, expires_in: CLAIM_WINDOW)
+            here = Throttle.crowded?(:claim, "claims:#{request.remote_ip}")
+            anywhere = Throttle.crowded?(:claim_ceiling, "claims")
 
-            from_here.to_i > ::Rails.configuration.masks.claim_limit ||
-              from_anywhere.to_i > ::Rails.configuration.masks.claim_ceiling
+            (here || anywhere).tap { |crowded| Throttle.hit!(here ? :claim : :claim_ceiling, address: request.remote_ip) if crowded }
           end
 
           def crowded
             [
               429,
-              { "content-type" => "text/plain; charset=utf-8", "cache-control" => "no-store", "retry-after" => CLAIM_WINDOW.to_i.to_s },
+              { "content-type" => "text/plain; charset=utf-8", "cache-control" => "no-store", "retry-after" => Throttle.budget(:claim).within.to_i.to_s },
               [ CROWDED ]
             ]
           end