masks-server 0.12.0 → 0.14.0

data/app/models/masks/server/event.rb

@@ -14,7 +14,7 @@ module Masks
       SESSION_EXPIRED = "session.expired".freeze
       LOGOUT_UNDELIVERED = "logout.undelivered".freeze
       LOGIN_REFUSED = "login.refused".freeze
-      LOGIN_THROTTLED = "login.throttled".freeze
+      LIMIT_REACHED = "limit.reached".freeze
 
       ACCOUNT_CREATED = "account.created".freeze
       ACCOUNT_EXPORTED = "account.exported".freeze
@@ -181,7 +181,7 @@ module Masks
       RELEASE_AVAILABLE = "release.available".freeze
 
       GRAVE = [
-        LOGIN_REFUSED, LOGIN_THROTTLED, LOGOUT_UNDELIVERED, REFRESH_REUSED, STREAM_FAILED,
+        LOGIN_REFUSED, LIMIT_REACHED, LOGOUT_UNDELIVERED, REFRESH_REUSED, STREAM_FAILED,
         DEVICE_BLOCKED, ACTOR_DELETED, AUTHENTICATOR_DISABLED, CONNECTION_REFUSED, DELEGATION_REFUSED,
         EXCHANGE_REFUSED, SIGN_IN_RISKY, SIGNAL_UNDELIVERED, TEXT_UNDELIVERED, SIGNAL_RECEIVED, MEMBERSHIP_ROLE_KEPT,
         ORGANIZATION_OWNERLESS, JOB_FAILED, HEALTH_FAILING

data/app/models/masks/server/health.rb

@@ -10,11 +10,19 @@ module Masks
       end
 
       SERVER = %w[jobs worker queue ldap metrics].freeze
-      TENANT = %w[mail origin domains keys].freeze
+      TENANT = %w[mail origin domains keys proxy].freeze
       NAMES = (SERVER + TENANT).freeze
 
       FAILING_KEY = "masks:health:failing".freeze
       ORIGIN_PREFIX = "masks:health:origin:".freeze
+      PROXY_KEY = "masks:health:proxy".freeze
+      PROXY_ADDRESSES = 5
+      PROXY_LOG = {
+        "untrusted" => "proxy: forwarded headers arrived from %{address}, which MASKS_TRUSTED_PROXIES does not list, so they were ignored",
+        "plain" => "proxy: %{address} forwards requests as plain http; have it send X-Forwarded-Proto: https"
+      }.freeze
+      ONE_ADDRESS_FLOOR = 20
+      LOOPBACK = /\A(?:(?:.+\.)?localhost|127(?:\.\d{1,3}){3}|\[::1\])\z/i
       KEEP = 1.day
       NOTE_EVERY = 10.minutes
       SMTP_TIMEOUT = 5
@@ -37,7 +45,7 @@ module Masks
       end
 
       def tenant_results
-        [ mail_result, origin_result, domains_result, keys_result ]
+        [ mail_result, origin_result, domains_result, keys_result, proxy_result ]
       end
 
       def store!(results)
@@ -203,6 +211,65 @@ module Masks
         "#{ORIGIN_PREFIX}#{tenant.id}"
       end
 
+      def note_proxy!(kind, address)
+        return if address.blank? || !PROXY_LOG.key?(kind)
+
+        now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        key = "proxy:#{kind}:#{address}"
+        last = noted[key]
+
+        return if last && now - last < NOTE_EVERY
+
+        noted[key] = now
+        ::Rails.logger.warn(format(PROXY_LOG.fetch(kind), address: address))
+
+        held = ::Rails.cache.read(PROXY_KEY) || {}
+        seen = (held[kind] ||= {})
+        seen[address] = Time.current.utc.iso8601 if seen.key?(address) || seen.size < PROXY_ADDRESSES
+        ::Rails.cache.write(PROXY_KEY, held, expires_in: KEEP)
+      end
+
+      def forget_proxy!
+        noted.keys.grep(/\Aproxy:/).each { |key| noted.delete(key) }
+        ::Rails.cache.delete(PROXY_KEY)
+      end
+
+      def proxy_result
+        held = ::Rails.cache.read(PROXY_KEY) || {}
+        untrusted = held["untrusted"].to_h.keys.sort
+        plain = held["plain"].to_h.keys.sort
+
+        return warning("proxy", "untrusted", addresses: untrusted) if untrusted.any?
+        return warning("proxy", "plain", addresses: plain) if plain.any?
+
+        address, count = sole_private_address
+
+        return warning("proxy", "one", address: address, count: count) if address
+
+        ok("proxy", "quiet")
+      end
+
+      def sole_private_address
+        origin = Current.tenant&.public_origin
+
+        return if origin.nil? || URI.parse(origin).host.to_s.match?(LOOPBACK)
+
+        recent = Event.where(created_at: 1.hour.ago..).where.not(ip_address: [ nil, "" ])
+        addresses = recent.distinct.limit(2).pluck(:ip_address)
+
+        return unless addresses.size == 1
+
+        count = recent.count
+
+        return if count < ONE_ADDRESS_FLOOR
+
+        address = IPAddr.new(addresses.first)
+
+        [ addresses.first, count ] if address.private? || address.loopback? || address.link_local?
+      rescue IPAddr::InvalidAddressError, URI::InvalidURIError
+        nil
+      end
+
       def domains_result
         return ok("domains", "none") unless DomainClaim.exists?
 
@@ -221,7 +288,7 @@ module Masks
         days = ((Time.current - active.activated_at) / 1.day).floor
         period = Current.tenant.key_rotation_days
 
-        return ok("keys", "manual", days: days) if period.nil?
+        return warning("keys", "manual", days: days) if period.nil?
         return warning("keys", "stale", days: days, period: period) if days > period
 
         ok("keys", "fresh", days: days, period: period)

data/app/models/masks/server/saml_identity/farewells.rb

@@ -11,6 +11,7 @@ module Masks
           held = ::Rails.cache.read(key)
 
           return nil unless held.is_a?(Hash) && held["client_id"] == client.client_id
+          return nil unless Replay.first?("saml-farewell", request_id, within: client.id, expires_in: WAIT)
 
           ::Rails.cache.delete(key)
           new(held["steps"], held["finish"])

data/app/models/masks/server/tenant.rb

@@ -31,6 +31,21 @@ module Masks
         end
       end
 
+      class Pooled < StandardError
+        def initialize(message = nil)
+          super(
+            message ||
+            "this server reaches Postgres through a pooler that hands out a different server " \
+            "connection for each transaction. The tenant masks sets on one connection is gone from " \
+            "the next, so a query would see no tenant's rows, or another tenant's. Connect masks to " \
+            "Postgres directly, or run the pooler in session mode."
+          )
+        end
+      end
+
+      POOL_PROBE = "masks.pool_probe".freeze
+      POOL_PROBE_ROUNDS = 3
+
       encrypts :pairwise_salt, :setup_token, key_provider: Server.tenant_key_provider
 
       attribute :uuid, default: -> { SecureRandom.uuid }
@@ -348,10 +363,28 @@ module Masks
 
           raise Exposed, held&.fetch("rolname", nil) unless held && held["bypasses"] == false
           raise Owner, held["rolname"] if held["owns"] && guards_ownership?
+          raise Pooled if pooled?
 
           @isolated = true
         end
 
+        def pooled?
+          return false if connection_pool.size < 2
+
+          POOL_PROBE_ROUNDS.times do
+            mine = SecureRandom.hex(8)
+            connection.exec_query("SELECT set_config($1, $2, false)", "probe", [ POOL_PROBE, mine ])
+
+            return false unless touched_another_connection?
+
+            return true unless connection.select_value("SELECT current_setting('#{POOL_PROBE}', true)") == mine
+          end
+
+          false
+        rescue ActiveRecord::ConnectionTimeoutError
+          false
+        end
+
         def role_privileges
           connection.select_one(<<~SQL)
             SELECT rolname, rolsuper OR rolbypassrls AS bypasses,
@@ -383,23 +416,34 @@ module Masks
         end
 
         def clear!
-          enter(nil)
+          enter(nil, for_transaction: false)
         end
 
         private
 
-          def enter(tenant)
+          def enter(tenant, for_transaction: connection.transaction_open?)
             Current.tenant = tenant
 
             connection.exec_query(
-              "SELECT set_config($1, $2, false)", "tenant",
-              [ TenantIsolation::SETTING, tenant&.id.to_s ]
+              "SELECT set_config($1, $2, $3)", "tenant",
+              [ TenantIsolation::SETTING, tenant&.id.to_s, for_transaction ]
             )
 
             connection.clear_query_cache
           rescue ActiveRecord::ConnectionNotEstablished, ActiveRecord::ConnectionFailed
             nil
           end
+
+          def touched_another_connection?
+            other = connection_pool.checkout
+
+            return false if other.equal?(connection)
+
+            other.exec_query("SELECT set_config($1, $2, false)", "probe", [ POOL_PROBE, "another connection" ])
+            true
+          ensure
+            connection_pool.checkin(other) if other
+          end
       end
 
       def signing_key

data/app/models/masks/server/throttle.rb

@@ -0,0 +1,165 @@
+module Masks
+  module Server
+    module Throttle
+      class Invalid < StandardError; end
+
+      Budget = Struct.new(:name, :to, :within, :about, :variable, keyword_init: true) do
+        def key
+          name.to_s
+        end
+
+        def limits
+          { to: to, within: within }
+        end
+
+        def reference
+          "| `#{variable}` | `#{key}` | #{to} in #{within.inspect} | #{about} |"
+        end
+      end
+
+      DEFAULTS = [
+        Budget.new(name: :attempt, to: 10, within: 3.minutes, variable: "MASKS_ATTEMPT_LIMIT",
+                   about: "Sign-in attempts from one IP address. Includes sign-in through a provider, failed LDAP binds, and app passwords."),
+        Budget.new(name: :account_attempt, to: 5, within: 3.minutes, variable: "MASKS_ACCOUNT_ATTEMPT_LIMIT",
+                   about: "Sign-in attempts against one account, from any IP address. Includes failed LDAP binds and app passwords. " \
+                          "Also how often a signed-in account changes its password, email address, or phone number, adds an " \
+                          "authenticator app, or approves a sign-in on another device."),
+        Budget.new(name: :recovery, to: 5, within: 15.minutes, variable: "MASKS_RECOVERY_LIMIT",
+                   about: "Codes and links sent by email or text message. Counted by IP address during sign-in, and by account for " \
+                          "every address or phone number a code goes to, including a phone added or changed during sign-in."),
+        Budget.new(name: :registration, to: 10, within: 10.minutes, variable: "MASKS_REGISTRATION_LIMIT",
+                   about: "Dynamic client registrations from one IP address, and new client metadata documents."),
+        Budget.new(name: :device_code, to: 30, within: 3.minutes, variable: "MASKS_DEVICE_CODE_LIMIT",
+                   about: "Device user codes entered from one IP address."),
+        Budget.new(name: :claim, to: 3, within: 1.hour, variable: "MASKS_CLAIM_LIMIT",
+                   about: "Tenants claimed from one IP address, when a subdomain template claims a tenant on its first visit. " \
+                          "Counted across the whole server."),
+        Budget.new(name: :claim_ceiling, to: 30, within: 1.hour, variable: "MASKS_CLAIM_CEILING",
+                   about: "Tenants claimed from all IP addresses together, under the same template. Counted across the whole server."),
+        Budget.new(name: :token, to: 60, within: 1.minute, variable: "MASKS_TOKEN_LIMIT", about: "Token requests from one IP address."),
+        Budget.new(name: :pushed_authorization, to: 60, within: 1.minute, variable: "MASKS_PUSHED_AUTHORIZATION_LIMIT", about: "Pushed authorization requests from one IP address."),
+        Budget.new(name: :device_authorization, to: 60, within: 1.minute, variable: "MASKS_DEVICE_AUTHORIZATION_LIMIT", about: "Device authorization requests from one IP address."),
+        Budget.new(name: :introspection, to: 120, within: 1.minute, variable: "MASKS_INTROSPECTION_LIMIT", about: "Token introspections from one IP address."),
+        Budget.new(name: :revocation, to: 120, within: 1.minute, variable: "MASKS_REVOCATION_LIMIT", about: "Token revocations from one IP address."),
+        Budget.new(name: :saml, to: 60, within: 1.minute, variable: "MASKS_SAML_LIMIT", about: "SAML sign-in and logout requests from one IP address."),
+        Budget.new(name: :forward_auth, to: 30, within: 1.minute, variable: "MASKS_FORWARD_AUTH_LIMIT", about: "Forward auth sign-ins started or finished from one IP address."),
+        Budget.new(name: :enrollment, to: 30, within: 1.minute, variable: "MASKS_ENROLLMENT_LIMIT", about: "Enrollment tokens redeemed from one IP address."),
+        Budget.new(name: :app_enrollment, to: 60, within: 1.hour, variable: "MASKS_APP_ENROLLMENT_LIMIT", about: "Enrollment tokens one app mints."),
+        Budget.new(name: :invitation, to: 30, within: 1.minute, variable: "MASKS_INVITATION_LIMIT", about: "Organization invitations one account sends or sends again."),
+        Budget.new(name: :export, to: 5, within: 1.hour, variable: "MASKS_EXPORT_LIMIT", about: "Account exports one account asks for."),
+        Budget.new(name: :access_request, to: 1, within: 1.hour, variable: "MASKS_ACCESS_REQUEST_LIMIT", about: "Times one account asks for access to one app."),
+        Budget.new(name: :signal, to: 600, within: 1.minute, variable: "MASKS_SIGNAL_LIMIT", about: "Security events received from one IP address."),
+        Budget.new(name: :scim, to: 600, within: 1.minute, variable: "MASKS_SCIM_LIMIT", about: "SCIM provisioning requests from one IP address.")
+      ].freeze
+
+      NAMES = DEFAULTS.map(&:key).freeze
+
+      module_function
+
+      def budgets
+        @budgets ||= DEFAULTS.to_h { |budget| [ budget.name, budget.dup.tap { |held| held.to = limit_for(budget) } ] }
+      end
+
+      def budget(name)
+        budgets.fetch(name.to_sym) { raise Invalid, "no limit is called #{name}. The limits are #{NAMES.join(', ')}." }
+      end
+
+      def limit(name)
+        budget(name).to
+      end
+
+      def limits(name)
+        budget(name).limits
+      end
+
+      def refused(name, &block)
+        held = budget(name)
+
+        proc { Throttle.hit!(held.name); instance_exec(&block) }
+      end
+
+      def key(name, by, scope: nil, named: nil)
+        held = budget(name)
+
+        [ "rate-limit", scope || "masks/server/#{held.key}", named, by ].compact.join(":")
+      end
+
+      def count!(name, by, scope: nil, named: nil)
+        ::Rails.cache.increment(key(name, by, scope: scope, named: named), 1, expires_in: budget(name).within)
+      end
+
+      def exceeded?(name, by, scope: nil, named: nil, times: 1)
+        ::Rails.cache.read(key(name, by, scope: scope, named: named)).to_i >= budget(name).to * times
+      end
+
+      def crowded?(name, by, scope: nil, named: nil, times: 1)
+        held = budget(name)
+
+        ::Rails.cache.increment(key(name, by, scope: scope, named: named), 1, expires_in: held.within).to_i > held.to * times
+      end
+
+      def hit!(name, actor: nil, client: nil, address: Current.ip_address, **details)
+        held = budget(name)
+
+        ::Rails.logger.info("masks: the #{held.key} limit of #{held.to} in #{held.within.inspect} was reached" \
+                            "#{address.present? ? " from #{address}" : ''}")
+
+        return if Current.tenant.nil?
+        return unless ::Rails.cache.write(key(name, "reached:#{address}"), true, unless_exist: true, expires_in: held.within)
+
+        Event.record!(Event::LIMIT_REACHED, actor: actor, by: nil, client: client, limit: held.key, **details)
+      end
+
+      def reference
+        DEFAULTS.map(&:reference)
+      end
+
+      def reset!
+        @budgets = nil
+        @declared = nil
+      end
+
+      def limit_for(budget)
+        from_env(budget) || declared.fetch(budget.key, nil) || budget.to
+      end
+
+      def from_env(budget)
+        value = ENV[budget.variable]
+
+        return nil if value.blank?
+
+        whole!(value, budget.variable)
+      end
+
+      def declared
+        @declared ||= read_declared(::Rails.configuration.masks.config_path)
+      end
+
+      def read_declared(path)
+        return {} if path.blank?
+
+        document = YAML.safe_load_file(path, aliases: false) || {}
+        limits = document.is_a?(Hash) ? document.fetch("limits", nil) || {} : {}
+
+        raise Invalid, "limits in #{path} must map each limit's name to a whole number" unless limits.is_a?(Hash)
+
+        unknown = limits.keys.map(&:to_s) - NAMES
+        raise Invalid, "#{path} sets limits called #{unknown.join(', ')}, which do not exist. The limits are #{NAMES.join(', ')}." if unknown.any?
+
+        limits.to_h { |name, value| [ name.to_s, whole!(value, "limits.#{name} in #{path}") ] }
+      rescue Errno::ENOENT, Psych::Exception
+        {}
+      end
+
+      def whole!(value, where)
+        count = Integer(value.to_s, 10)
+
+        raise Invalid, "#{where} is #{value.inspect}. A limit is a whole number, 1 or more." if count < 1
+
+        count
+      rescue ArgumentError, TypeError
+        raise Invalid, "#{where} is #{value.inspect}. A limit is a whole number, 1 or more."
+      end
+    end
+  end
+end

data/app/views/masks/server/handshakes/show.html.erb

@@ -12,21 +12,15 @@
 <% hot, rest = @scopes.to_a.partition { |scope, _| heeded_scope?(scope) } %>
 <% after_sign_out = @handshake.try(:post_logout_redirect_uri) %>
 
-<div class="auth-pair">
+<div class="auth-solo">
   <span class="auth-mark auth-mark-client" aria-hidden="true"><%= name.to_s.first&.upcase %></span>
-  <span class="auth-wire"></span>
-  <%= tenant_mark(Masks::Server::Current.tenant) %>
 </div>
 
 <div class="prompt-head">
   <h1 class="prompt-title"><%= t(@existing ? ".title_again" : ".title", name: name, tenant: tenant) %></h1>
 
-  <p class="handshake-origin">
-    <span class="handshake-origin-label"><%= t(".runs_at") %></span>
-    <span class="handshake-origin-value"><%= @handshake.origin %></span>
-  </p>
-
   <p class="prompt-lede">
+    <%= t(".runs_at", name: name, origin: @handshake.origin) %>
     <%= t(@existing ? ".lede_again_html" : ".lede_html", name: name, tenant: tenant) %>
   </p>
 </div>

data/app/views/masks/server/logins/_consent.html.erb

@@ -1,15 +1,14 @@
 <% state = login.state("consent") %>
 <% client = login.client_json || {} %>
 <% hot, rest = ranked_scopes(Masks::Server::ResourceMetadata.describe(state.audience, state.scopes)) %>
+<% all = hot + rest %>
 
-<div class="auth-pair">
+<div class="auth-solo">
   <% if client["logo"] %>
     <%= image_tag client["logo"], alt: "", class: "auth-mark auth-mark-client auth-mark-logo", referrerpolicy: "no-referrer" %>
   <% else %>
     <span class="auth-mark auth-mark-client" aria-hidden="true"><%= client["name"].to_s.strip.first&.upcase %></span>
   <% end %>
-  <span class="auth-wire"></span>
-  <%= tenant_mark(Masks::Server::Current.tenant) %>
 </div>
 
 <%= render "masks/server/logins/head", title: t(".title", client: login.client&.name) %>
@@ -20,48 +19,30 @@
   <div class="ledger-row">
     <span class="ledger-label"><%= t(".access") %></span>
 
-    <% if hot.empty? && rest.empty? %>
+    <% if all.empty? %>
       <p class="empty"><%= t(".no_access") %></p>
+    <% else %>
+      <ul class="plain-list">
+        <% all.each do |_, description| %>
+          <li><%= description %></li>
+        <% end %>
+      </ul>
     <% end %>
-
-    <ul class="grant-scopes">
-      <% hot.each do |scope, description| %>
-        <li class="grant-scope grant-scope-hot">
-          <span><%= description %></span>
-          <span class="chip-key"><%= scope %></span>
-        </li>
-      <% end %>
-
-      <% if hot.any? && rest.any? %>
-        <li class="grant-scope-split"></li>
-      <% end %>
-
-      <% rest.each do |scope, description| %>
-        <li class="grant-scope">
-          <span><%= description %></span>
-          <span class="chip-key"><%= scope %></span>
-        </li>
-      <% end %>
-    </ul>
   </div>
 
   <% if state.audience.any? %>
     <div class="ledger-row">
-      <span class="ledger-label"><%= t(".audience") %></span>
-      <% state.audience.each do |resource| %>
-        <span class="ledger-value aside-mono"><%= resource %></span>
-      <% end %>
+      <span class="aside"><%= t(".audience", resources: state.audience.join(", ")) %></span>
     </div>
   <% end %>
 
   <% if (details = state.details&.described).present? %>
     <div class="ledger-row">
       <span class="ledger-label"><%= t(".details") %></span>
-      <ul class="grant-scopes">
+      <ul class="plain-list">
         <% details.each do |detail| %>
-          <li class="grant-scope grant-scope-hot grant-detail">
-            <span><%= detail["label"] %></span>
-            <span class="chip-key"><%= detail["type"] %></span>
+          <li>
+            <%= detail["label"] %>
             <% if detail["fields"].any? %>
               <dl class="grant-fields">
                 <% detail["fields"].each do |name, value| %>
@@ -75,23 +56,41 @@
       </ul>
     </div>
   <% end %>
+</div>
 
-  <% if client["returnsTo"] %>
+<% links = { "site" => t(".site", client: client["name"]), "terms" => t(".terms"), "privacy" => t(".privacy") }.select { |key, _| client[key] } %>
+<details class="disclosure handshake-more">
+  <summary class="textlink"><%= t(".more") %></summary>
+
+  <div class="slab">
     <div class="ledger-row">
-      <span class="ledger-label"><%= t(".returns_to") %></span>
-      <span class="ledger-value aside-mono"><%= client["returnsTo"] %></span>
+      <span class="ledger-label"><%= t(".scopes") %></span>
+      <ul class="grant-scopes">
+        <% all.each do |scope, description| %>
+          <li class="grant-scope">
+            <span><%= description %></span>
+            <span class="chip-key"><%= scope %></span>
+          </li>
+        <% end %>
+      </ul>
     </div>
-  <% end %>
-</div>
 
-<% links = { "site" => t(".site", client: client["name"]), "terms" => t(".terms"), "privacy" => t(".privacy") }.select { |key, _| client[key] } %>
-<% if links.any? %>
-  <p class="aside client-links">
-    <% links.each do |key, label| %>
-      <%= link_to label, client[key], class: "textlink", rel: "noopener noreferrer", target: "_blank" %>
+    <% if client["returnsTo"] %>
+      <div class="ledger-row">
+        <span class="ledger-label"><%= t(".returns_to") %></span>
+        <span class="ledger-value aside-mono"><%= client["returnsTo"] %></span>
+      </div>
     <% end %>
-  </p>
-<% end %>
+
+    <% if links.any? %>
+      <p class="aside client-links">
+        <% links.each do |key, label| %>
+          <%= link_to label, client[key], class: "textlink", rel: "noopener noreferrer", target: "_blank" %>
+        <% end %>
+      </p>
+    <% end %>
+  </div>
+</details>
 
 <div class="action-row">
   <%= form_with url: login_path, method: :post, id: "consent", class: "action-grow" do |form| %>

data/app/views/masks/server/logins/_enrol.html.erb

@@ -7,7 +7,7 @@
 
 <div class="flow<%= " setup" if signing_up %>">
   <% if signing_up %>
-    <%= render "masks/server/logins/signup_head", login: login, at: 2, mark: login.actor&.identifier.to_s %>
+    <%= render "masks/server/logins/signup_head", login: login, at: 2 %>
 
     <p class="aside"><%= enrolment["required"] ? t(".lede") : t(".lede_optional") %></p>
   <% else %>

data/app/views/masks/server/logins/_setup_configure.html.erb

@@ -1,7 +1,7 @@
 <% configure = login.state("configure").as_json["configure"] %>
 
 <div class="setup flow">
-  <%= render "masks/server/logins/signup_head", login: login, at: 3, mark: login.actor&.identifier.to_s %>
+  <%= render "masks/server/logins/signup_head", login: login, at: 3 %>
 
   <%= form_with url: login_path, method: :post, id: "setup-configure", class: "flow" do |form| %>
     <%= hidden_field_tag :rid, login.rid %>
@@ -12,11 +12,6 @@
         <%= form.text_field :called, value: configure["called"], class: "control" %>
         <span class="field-hint"><%= t(".called_hint") %></span>
       </label>
-
-      <div class="ledger-row">
-        <span class="ledger-label"><%= t("logins.signing_up.origin") %></span>
-        <span class="ledger-value aside-mono"><%= Masks::Server::Current.origin %></span>
-      </div>
     </div>
 
     <button type="submit" name="event" value="setup-configure" class="action">
@@ -25,6 +20,7 @@
   <% end %>
 
   <p class="aside">
+    <%= t("logins.signing_up.origin", origin: Masks::Server::Current.origin) %>
     <%= t("logins.signing_up.once") %>
     <%= link_to t("logins.signing_up.docs"), Rails.configuration.masks.docs_url,
           class: "textlink", rel: "noopener", target: "_blank" %>

data/app/views/masks/server/logins/_signup.html.erb

@@ -4,8 +4,7 @@
 <% done = ->(field) { " ledger-step-done" if value.(field).present? } %>
 
 <div class="setup flow">
-  <%= render "masks/server/logins/signup_head", login: login, at: 1,
-                                   mark: value.("nickname").presence || value.("email") %>
+  <%= render "masks/server/logins/signup_head", login: login, at: 1 %>
 
   <%= form_with url: login_path, method: :post, id: "signup", class: "flow" do |form| %>
     <%= hidden_field_tag :rid, login.rid %>
@@ -51,13 +50,6 @@
           <%= render "masks/server/logins/hint", login: login, field: "phone" %>
         </label>
       <% end %>
-
-      <% if login.signing_up["firstRun"] %>
-        <div class="ledger-row">
-          <span class="ledger-label"><%= t("logins.signing_up.origin") %></span>
-          <span class="ledger-value aside-mono"><%= Masks::Server::Current.origin %></span>
-        </div>
-      <% end %>
     </div>
 
     <% if signup["work"] %>
@@ -71,6 +63,7 @@
 
   <% if login.signing_up["firstRun"] %>
     <p class="aside">
+      <%= t("logins.signing_up.origin", origin: Masks::Server::Current.origin) %>
       <%= t("logins.signing_up.once") %>
       <%= link_to t("logins.signing_up.docs"), Rails.configuration.masks.docs_url,
             class: "textlink", rel: "noopener", target: "_blank" %>

data/app/views/masks/server/logins/_signup_credentials.html.erb

@@ -2,8 +2,7 @@
 <% rows = %w[name nickname email phone].filter_map { |field| [ field, signup[field] ] if signup[field].present? } %>
 
 <div class="setup flow">
-  <%= render "masks/server/logins/signup_head", login: login, at: 2,
-                                   mark: signup["nickname"].presence || signup["email"] %>
+  <%= render "masks/server/logins/signup_head", login: login, at: 2 %>
 
   <%= form_with url: login_path, method: :post, id: "signup-credentials", class: "flow" do |form| %>
     <%= hidden_field_tag :rid, login.rid %>

data/app/views/masks/server/logins/_signup_head.html.erb

@@ -1,20 +1,10 @@
 <% tenant = Masks::Server::Current.tenant&.name.to_s %>
 <% signing_up = login.signing_up %>
 
-<div class="auth-pair">
-  <span class="auth-mark auth-mark-client<%= " auth-mark-pending" if mark.blank? %>" aria-hidden="true"><%= mark.to_s.first&.upcase %></span>
-  <span class="auth-wire"></span>
-  <% if signing_up["firstRun"] %>
-    <img src="/masks-public/icon.svg" alt="" class="auth-mark auth-mark-rose">
-  <% else %>
-    <%= tenant_mark(Masks::Server::Current.tenant) %>
-  <% end %>
-</div>
-
 <% if signing_up["firstRun"] %>
   <%= render "masks/server/logins/head", cap: t("logins.signing_up.setup_cap"), title: t("logins.signing_up.setup_title"), name: tenant %>
 <% else %>
-  <%= render "masks/server/logins/head", title: t("logins.signing_up.signup_title"), name: tenant %>
+  <%= render "masks/server/logins/head", title: t("logins.signing_up.signup_title") %>
 <% end %>
 
 <%= render "masks/server/logins/steps", steps: signing_up["steps"], at: local_assigns[:at] || signing_up["steps"].length %>