masks-server 0.7.0 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 670bf543e143915a6be6c9ca44965b2a66315bf479d60ec190b2cbc53fe939bb
-  data.tar.gz: 8b1fabb6b7597f23802f81e07b966992a69cd9ba8bd03f070812729f246b66a6
+  metadata.gz: '0815510a0ee659d9ba2cf35bb8840d7a3a7b7abb7306e0e0cf3f64fd7890d7dd'
+  data.tar.gz: 188b4436824c6f113da49a7880ad15d6f4d0c915f5c5df9b94ba7affcb51fca8
 SHA512:
-  metadata.gz: 96e59cfb63394b1fe6be72fcb2320c1ed401951ce6eb681600f405221eda392040f4d6f84a918641e9de5de236f563479e532c155c1fe015d5f0d53301d9f4d1
-  data.tar.gz: a5733b84f8c14b7bc86e9b3ca2099b471fad489ac53486a71386f92e9fb10076d45c977387672236d1db039dc06218547fd3e214e65a533d322b3efc80f19bdb
+  metadata.gz: faeda2a8132f3e2e92ce8a1f41d235cae52f0640ad33ed3220d526619c5ecd113fece66af5923cb8e610564399ba3db0f22bdd16e9e0306d0155ba63f9e13f91
+  data.tar.gz: bef27fdefa6bc7d1f88a386ac23261cad8b487137ea8130c0bfa41467f7bbec11b59058386ceb0fabe0f97cca1a914a1a3a9aaef6c74a48478b266e3a9c62858

data/app/controllers/masks/server/enrollments_controller.rb

@@ -0,0 +1,66 @@
+module Masks
+  module Server
+    class EnrollmentsController < ApplicationController
+      include TokenPresented
+
+      rate_limit to: 30, within: 1.minute,
+                 by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
+                 with: -> {
+                   render json: {
+                     "error" => "too_many_requests",
+                     "error_description" => "too many enrollment tokens asked for from this address"
+                   }, status: :too_many_requests
+                 }
+
+      before_action :no_store!
+
+      def create
+        client = authenticate_app!
+        token = EnrollmentToken.issue!(client, scope: params[:scope], name: params[:client_name],
+                                               expires_in: params[:expires_in])
+
+        Event.record!(Event::CLIENT_ENROLLMENT_ISSUED, client: client, scopes: token.scopes,
+                                                       name: token.held("name"), expires_at: token.expires_at.iso8601)
+
+        render json: {
+          "initial_access_token" => token.secret,
+          "expires_in" => token.expires_in,
+          "scope" => token.scopes
+        }, status: :created
+      rescue Client::EnrollmentRefused => e
+        render json: { "error" => "invalid_request", "error_description" => e.message }, status: :bad_request
+      end
+
+      def destroy
+        app = authenticate_app!
+        machine = app.enrolled.find_by(client_id: params[:machine].to_s)
+
+        return not_enrolled if machine.nil?
+
+        revoked = machine.unenroll!
+
+        Event.record!(Event::CLIENT_UNENROLLED, client: machine, name: machine.name, enrolled_by: app.client_id,
+                                                  revoked: revoked)
+
+        head :no_content
+      end
+
+      private
+
+        def authenticate_app!
+          client = authenticate_client!
+
+          client_refused!("a public client proves nothing about itself, so it enrolls and unenrolls nothing") if client.public?
+
+          client
+        end
+
+        def not_enrolled
+          render json: {
+            "error" => "invalid_request",
+            "error_description" => "that client was not enrolled by this app"
+          }, status: :not_found
+        end
+    end
+  end
+end

data/app/controllers/masks/server/introspections_controller.rb

@@ -13,7 +13,7 @@ module Masks
         client = authenticate_client!
         token = presented_token
 
-        return render json: INACTIVE unless token&.live? && entitled?(client, token)
+        return render json: INACTIVE unless token&.live? && !token.client&.archived? && entitled?(client, token)
 
         render json: described(token)
       end
@@ -22,7 +22,7 @@ module Masks
 
         def entitled?(client, token)
           return true if token.client_id == client.id
-          return false unless client.approved?
+          return false if client.enrolled? || !client.approved?
 
           (Array(token.audience) & Array(client.resources)).any?
         end

data/app/controllers/masks/server/registrations_controller.rb

@@ -14,6 +14,7 @@ module Masks
 
       before_action :no_store!
       before_action :require_registration_token, except: :create
+      before_action :refuse_enrolled, only: :update
 
       def create
         return redeem if bearer.present?
@@ -26,7 +27,7 @@ module Masks
         render json: issued(client), status: :created
       rescue ActiveRecord::RecordInvalid => e
         invalid_metadata(e.record.errors.full_messages.join("; "))
-      rescue Client::ScopesUnavailable => e
+      rescue Client::ScopesUnavailable, Client::EnrollmentRefused => e
         invalid_metadata(e.message)
       end
 
@@ -47,6 +48,8 @@ module Masks
       end
 
       def destroy
+        return unenroll if @client.enrolled?
+
         @client.update!(archived_at: Time.current)
 
         Event.record!(Event::CLIENT_ARCHIVED, client: @client, name: @client.name)
@@ -56,7 +59,27 @@ module Masks
 
       private
 
+        def unenroll
+          revoked = @client.unenroll!
+
+          Event.record!(Event::CLIENT_UNENROLLED, client: @client, name: @client.name,
+                                                  enrolled_by: @client.enrolled_by&.client_id, revoked: revoked)
+
+          head :no_content
+        end
+
+        def refuse_enrolled
+          return unless @client.enrolled?
+
+          render json: {
+            "error" => "access_denied",
+            "error_description" => "an enrolled machine is changed only by the app that enrolled it"
+          }, status: :forbidden
+        end
+
         def redeem
+          return enrolled(@enrolled) if (@enrolled = EnrollmentToken.redeem!(bearer, body))
+
           token = InitialAccessToken.claim(bearer)
 
           return unauthorized("that initial access token is not valid or has expired") if token&.client.nil?
@@ -64,6 +87,13 @@ module Masks
           render json: issued(token.issue!), status: :created
         end
 
+        def enrolled(client)
+          Event.record!(Event::CLIENT_ENROLLED, client: client, name: client.name,
+                                                enrolled_by: client.enrolled_by.client_id)
+
+          render json: issued(client), status: :created
+        end
+
         def bearer
           request.authorization.to_s[/\ABearer (\S+)\z/, 1]
         end

data/app/graphql/masks/server/manage/types/client_type.rb

@@ -57,6 +57,10 @@ module Masks
           field :dynamic, Boolean, null: false
           field :approved_at, GraphQL::Types::ISO8601DateTime
           field :approved_by, ActorType
+          field :enrolled_by, ClientType,
+                description: "The app that enrolled this client as one of its machines. Archiving that app archives this client."
+          field :enrolled, [ ClientType ], null: false,
+                description: "The machines this app enrolled that are not archived."
           field :archived_at, GraphQL::Types::ISO8601DateTime
           field :secret_expires_at, GraphQL::Types::ISO8601DateTime
           field :created_at, GraphQL::Types::ISO8601DateTime, null: false
@@ -75,6 +79,10 @@ module Masks
             argument :limit, Integer, required: false
           end
 
+          def enrolled
+            object.enrolled.active.order(:name)
+          end
+
           def tokens(limit: nil)
             Masks::Server::Token.where(kind: TokenType::GRANTS, client_id: object.id)
                    .live

data/app/graphql/masks/server/manage/types/query_type.rb

@@ -169,6 +169,8 @@ module Masks
             argument :action, String, required: false
             argument :grave, Boolean, required: false
             argument :organization, ID, required: false
+            argument :since, GraphQL::Types::ISO8601DateTime, required: false,
+                                                               description: "Only events recorded at or after this time."
             argument :after_id, ID, required: false
             argument :limit, Integer, required: false
           end
@@ -180,6 +182,8 @@ module Masks
             argument :action, String, required: false
             argument :grave, Boolean, required: false
             argument :organization, ID, required: false
+            argument :since, GraphQL::Types::ISO8601DateTime, required: false,
+                                                               description: "Only events recorded at or after this time."
           end
 
           field :event_actions, [ EventActionType ], null: false
@@ -484,7 +488,7 @@ module Masks
               scope.where("name ILIKE :term OR client_id = :exact", term: term, exact: search.strip)
             end
 
-            def event_scope(actor: nil, client: nil, device: nil, action: nil, grave: false, organization: nil)
+            def event_scope(actor: nil, client: nil, device: nil, action: nil, grave: false, organization: nil, since: nil)
               subject = actor.present? ? Actor.find_by(uuid: actor) : nil
               group = organization.present? ? Masks::Server::Organization.find_by(key: organization) : nil
 
@@ -504,6 +508,7 @@ module Masks
               scope = scope.where(organization: group) if group
               scope = scope.where(action: action) if action.present?
               scope = scope.where(action: Masks::Server::Event::GRAVE) if grave
+              scope = scope.where(created_at: since..) if since
 
               scope
             end

data/app/helpers/masks/server/application_helper.rb

@@ -15,7 +15,6 @@ module Masks
           .auth-page {
             --signal: #{accent};
             --signal-ink: #{tenant.accent_ink};
-            --came: #{accent};
             --brass: #{accent};
             --ring: color-mix(in oklab, #{accent} 30%, transparent);
           }

data/app/helpers/masks/server/scopes_helper.rb

@@ -3,13 +3,41 @@ module Masks
     module ScopesHelper
       CONSEQUENTIAL = /(:write|:command|:exec|:delete|:admin)\z|\Aoffline_access\z|\Amasks:manage(:[a-z]+)?\z|\Amasks:delegate:./
 
+      SEEN = [
+        Scopes::OPENID, Scopes::PROFILE, Scopes::EMAIL,
+        Scopes::IDENTITIES, Scopes::ORGANIZATION, Scopes::GROUPS
+      ].freeze
+
       def consequential_scope?(scope)
         scope.to_s.match?(CONSEQUENTIAL)
       end
 
+      def heeded_scope?(scope)
+        scope == Scopes::DELEGATE || consequential_scope?(scope)
+      end
+
       def ranked_scopes(described)
         described.to_a.partition { |scope, _| consequential_scope?(scope) }
       end
+
+      def plain_scopes(described, areas: [])
+        held = { sees: [], heeds: [], also: [] }
+
+        described.to_a.each do |scope, description|
+          next if areas.include?(scope)
+
+          group =
+            if heeded_scope?(scope) then :heeds
+            elsif SEEN.include?(scope) then :sees
+            else :also
+            end
+
+          held[group] << [ scope, description ]
+        end
+
+        held[:sees].sort_by! { |scope, _| SEEN.index(scope) }
+        held
+      end
     end
   end
 end

data/app/jobs/masks/server/cleanup_job.rb

@@ -32,6 +32,7 @@ module Masks
           SigningKey.where.not(retired_at: nil).where(retired_at: ...cutoff).delete_all
           Event.where(created_at: ...tenant.event_retention.ago).in_batches(of: BATCH).delete_all
           Members.purge_lapsed!
+          Replay.where(expires_at: ...Time.current).in_batches(of: BATCH).delete_all
         end
 
         def sweep_tokens(cutoff)

data/app/models/masks/server/client.rb

@@ -26,6 +26,7 @@ module Masks
       CHALLENGE_METHODS = %w[S256].freeze
       LOOPBACK = %w[localhost 127.0.0.1 ::1].freeze
       DEFAULT_SCOPES = Scopes::STANDARD
+      MACHINE_ACCESS_LIFETIME = 10.minutes
       LINKS = %i[client_uri tos_uri policy_uri].freeze
       METADATA_URIS = (LINKS + [ :logo_uri ]).freeze
       URI_LIMIT = 2048
@@ -47,12 +48,15 @@ module Masks
       ].freeze
 
       class ScopesUnavailable < StandardError; end
+      class EnrollmentRefused < StandardError; end
 
       has_many :tokens, dependent: :destroy
       has_many :consents, dependent: :destroy
       has_many :delegations, dependent: :destroy
       has_many :saml_participations, dependent: :delete_all
       has_many :namespaces, -> { order(:name) }, dependent: :nullify
+      has_many :enrolled, class_name: "Client", foreign_key: :enrolled_by_id, inverse_of: :enrolled_by,
+                          dependent: :nullify
       has_one :logo, class_name: "ClientLogo", dependent: :delete
 
       validate :allowed_groups_are_named
@@ -86,8 +90,10 @@ module Masks
       normalizes(*METADATA_URIS, with: ->(value) { value.to_s.strip.presence })
 
       after_commit :refresh_logo!, on: %i[create update], if: :saved_change_to_logo_uri?
+      after_update :archived!, if: -> { saved_change_to_archived_at? && archived? }
 
       belongs_to :approved_by, class_name: "Actor", optional: true
+      belongs_to :enrolled_by, class_name: "Client", optional: true, inverse_of: :enrolled
       belongs_to :sign_in_policy, optional: true
 
       scope :approved, -> { where.not(approved_at: nil) }
@@ -132,7 +138,7 @@ module Masks
         def approved_for(resource)
           return nil if resource.blank?
 
-          active.approved.where("resources @> ?", [ resource.to_s ].to_json).first
+          active.approved.where(enrolled_by_id: nil).where("resources @> ?", [ resource.to_s ].to_json).first
         end
 
         def register!(metadata)
@@ -169,6 +175,37 @@ module Masks
           )
         end
 
+        def enroll!(token, metadata)
+          app = token.client
+          app&.lock!
+          refusal = app&.enrollment_refusal(token.scope_list)
+
+          raise EnrollmentRefused, refusal || "the app that issued this enrollment token is gone" if app.nil? || refusal
+
+          held = metadata.to_h.stringify_keys
+
+          raise EnrollmentRefused, "jwks_uri is not accepted here; register the public keys as jwks" if held["jwks_uri"].present?
+          raise EnrollmentRefused, "jwks is required: the machine signs in with its own key" if held["jwks"].blank?
+
+          new(
+            client_id: SecureRandom.uuid,
+            name: held["client_name"].to_s.strip.presence || token.held("name") || "A machine",
+            jwks: held["jwks"],
+            token_endpoint_auth_method: PRIVATE_KEY_JWT,
+            grant_types: [ CLIENT_CREDENTIALS ],
+            response_types: [],
+            dpop_bound_access_tokens: true,
+            resources: app.resources,
+            allowed_scopes: Scopes.join(token.scope_list),
+            application_type: "native",
+            subject_type: Subjects::PUBLIC,
+            enrolled_by: app,
+            access_token_lifetime: MACHINE_ACCESS_LIFETIME.to_i,
+            approved_at: Time.current,
+            dynamic: false
+          ).issue_credentials!
+        end
+
         def bounded(requested)
           reserved = Scopes.reserved(requested) + Scopes.list(requested).select { |s| Scopes.prefix?(s) }
 
@@ -216,6 +253,38 @@ module Masks
         end
       end
 
+      def enrollment_refusal(scopes)
+        return "an archived client enrolls nothing" if archived?
+        return "a public client enrolls nothing" if public?
+        return "only an approved client enrolls machines" unless approved?
+        return "a client enrolls machines only after it claims a namespace" if namespaces.empty?
+        return "a scope is required" if Scopes.list(scopes).empty?
+
+        held = namespaces.map(&:name)
+        outside = Scopes.list(scopes).select do |scope|
+          Scopes.prefix?(scope) || scope.start_with?(Scopes::NAMESPACE) || !Scopes.covered?(held, scope)
+        end
+
+        "#{Scopes.join(outside)} is outside #{Scopes.join(held)}" if outside.any?
+      end
+
+      def enrolled?
+        enrolled_by_id.present?
+      end
+
+      def unenroll!
+        transaction do
+          revoked = end_tokens!
+          update!(archived_at: Time.current) unless archived?
+          revoked
+        end
+      end
+
+      def end_tokens!
+        now = Time.current
+        tokens.where(consumed_at: nil).update_all(consumed_at: now, updated_at: now)
+      end
+
       def public?
         token_endpoint_auth_method == "none"
       end
@@ -412,6 +481,17 @@ module Masks
 
       private
 
+        def archived!
+          end_tokens!
+
+          machines = enrolled.active.pluck(:id)
+          return if machines.empty?
+
+          now = Time.current
+          Client.where(id: machines).update_all(archived_at: archived_at, updated_at: now)
+          Token.where(client_id: machines, consumed_at: nil).update_all(consumed_at: now, updated_at: now)
+        end
+
         def allowed_groups_are_named
           unknown = allowed_groups.grep_v(ALLOWED_GROUP)
 

data/app/models/masks/server/client_keys.rb

@@ -9,6 +9,8 @@ module Masks
       SECRET = %w[d p q dp dq qi k].freeze
       ALGORITHMS = %w[RS256 RS384 RS512 PS256 PS384 PS512 ES256 ES384 ES512].freeze
       KINDS = %w[RSA EC].freeze
+      CURVES = %w[P-256 P-384 P-521].freeze
+      SHORTEST_RSA = 2048
       LEEWAY = 30
       LONGEST = 1.hour
 
@@ -23,8 +25,11 @@ module Masks
             raise Refused, "every key must be a JSON object" unless key.is_a?(Hash)
             raise Refused, "#{key['kty'].presence || 'that'} is not a kind of key a client signs with" unless KINDS.include?(key["kty"])
             raise Refused, "a client's keys must be public" if key.keys.any? { |field| SECRET.include?(field.to_s) }
+            raise Refused, "#{key['crv'].presence || 'that'} is not a curve a client signs with" if key["kty"] == "EC" && !CURVES.include?(key["crv"])
 
-            JWT::JWK.new(key).verify_key
+            verified = JWT::JWK.new(key).verify_key
+
+            raise Refused, "an RSA key must be at least #{SHORTEST_RSA} bits" if verified.is_a?(OpenSSL::PKey::RSA) && verified.n.num_bits < SHORTEST_RSA
           end
 
           held

data/app/models/masks/server/enrollment_token.rb

@@ -0,0 +1,54 @@
+module Masks
+  module Server
+    class EnrollmentToken < Token
+      SHORTEST = 1.minute
+      LONGEST = 1.hour
+
+      class << self
+        def lifetime
+          15.minutes
+        end
+
+        def issue!(client, scope:, name: nil, expires_in: nil)
+          scopes = Scopes.list(scope)
+          refusal = client.enrollment_refusal(scopes)
+
+          raise Client::EnrollmentRefused, refusal if refusal
+
+          mint!(
+            client: client,
+            scopes: Scopes.join(scopes),
+            audience: client.resources,
+            payload: { "name" => name.to_s.strip.presence }.compact,
+            expires_at: lasting(expires_in).from_now
+          )
+        end
+
+        def redeem!(secret, metadata)
+          transaction(requires_new: true) do
+            token = claim(secret)
+
+            next nil if token.nil?
+
+            Client.enroll!(token, metadata)
+          end
+        end
+
+        private
+
+          def lasting(expires_in)
+            return lifetime if expires_in.blank?
+
+            seconds = Integer(expires_in.to_s, 10)
+
+            raise ArgumentError unless seconds.between?(SHORTEST.to_i, LONGEST.to_i)
+
+            seconds.seconds
+          rescue ArgumentError
+            raise Client::EnrollmentRefused,
+                  "expires_in must be between #{SHORTEST.to_i} and #{LONGEST.to_i} seconds"
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/event.rb

@@ -106,6 +106,9 @@ module Masks
       CLIENT_RESTORED = "client.restored".freeze
       CLIENT_SECRET_ROTATED = "client.secret_rotated".freeze
       CLIENT_LOGO_REFUSED = "client.logo_refused".freeze
+      CLIENT_ENROLLMENT_ISSUED = "client.enrollment_issued".freeze
+      CLIENT_ENROLLED = "client.enrolled".freeze
+      CLIENT_UNENROLLED = "client.unenrolled".freeze
 
       TOKEN_REVOKED = "token.revoked".freeze
       SAML_ASSERTED = "saml.asserted".freeze

data/app/models/masks/server/issuer.rb

@@ -163,6 +163,7 @@ module Masks
           "pushed_authorization_request_endpoint" => "#{url}/par",
           "device_authorization_endpoint" => "#{url}/device_authorization",
           "handshake_endpoint" => "#{url}/handshake",
+          "enrollment_endpoint" => "#{url}/enrollments",
           "masks_protocol_version" => Masks::PROTOCOL_VERSION,
           "revocation_endpoint" => "#{url}/revoke",
           "introspection_endpoint" => "#{url}/introspect",

data/app/models/masks/server/namespace.rb

@@ -17,12 +17,15 @@ module Masks
           Scopes.list(scopes).select { |scope| Scopes.prefix?(scope) && !scope.start_with?(Scopes::NAMESPACE) }
         end
 
-        def named(scopes)
-          where(name: prefixes(scopes))
+        def overlapping(scopes)
+          names = prefixes(scopes)
+          return none if names.empty?
+
+          where(names.map { "(starts_with(name, ?) OR starts_with(?, name))" }.join(" OR "), *names.flat_map { |name| [ name, name ] })
         end
 
         def taken(handshake)
-          named(handshake.scopes).where.not(resource: handshake.resource.to_s)
+          overlapping(handshake.scopes).where.not(resource: handshake.resource.to_s)
         end
 
         def refusal(handshake)

data/app/models/masks/server/replay.rb

@@ -1,10 +1,28 @@
 module Masks
   module Server
-    module Replay
-      def self.first?(kind, id, expires_in:, within: nil)
-        key = [ kind, Current.tenant&.id, within, Digest::SHA256.hexdigest(id.to_s) ].compact.join(":")
+    class Replay < ApplicationRecord
+      include TenantScoped
 
-        ::Rails.cache.write(key, true, expires_in: expires_in, unless_exist: true)
+      class << self
+        def first?(kind, id, expires_in:, within: nil)
+          now = Time.current
+          claimed = connection.exec_query(sanitize_sql_array([ <<~SQL, Current.tenant.id, kind.to_s, digest(within, id), now + expires_in, now, now ]), "Replay")
+            INSERT INTO replays (tenant_id, kind, digest, expires_at, created_at)
+            VALUES (?, ?, ?, ?, ?)
+            ON CONFLICT (tenant_id, kind, digest) DO UPDATE
+              SET expires_at = EXCLUDED.expires_at, created_at = EXCLUDED.created_at
+              WHERE replays.expires_at <= ?
+            RETURNING id
+          SQL
+
+          claimed.rows.any?
+        end
+
+        private
+
+          def digest(within, id)
+            Digest::SHA256.hexdigest([ within&.to_s, id.to_s ].to_json)
+          end
       end
     end
   end

data/app/models/masks/server/token.rb

@@ -16,6 +16,7 @@ module Masks
         "password_reset" => "PasswordReset",
         "confirmation" => "ConfirmationCode",
         "initial_access" => "InitialAccessToken",
+        "enrollment" => "EnrollmentToken",
         "request" => "PendingRequest",
         "login" => "PendingLogin",
         "pushed" => "PushedRequest",

data/app/views/layouts/masks/server/manage.html.erb

@@ -1,11 +1,11 @@
 <!DOCTYPE html>
-<html lang="<%= Masks::Server::Locales.tag %>" data-theme="rose">
+<html lang="<%= Masks::Server::Locales.tag %>">
   <head>
     <title><%= content_for(:title) || "Manage #{Masks::Server::Current.tenant&.name}" %></title>
     <meta charset="utf-8">
     <meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
     <meta name="masks-root" content="<%= request.script_name %>">
-    <meta name="color-scheme" content="dark">
+    <meta name="color-scheme" content="light dark">
     <link rel="icon" href="/masks-public/favicon.svg" type="image/svg+xml">
     <link rel="apple-touch-icon" href="/masks-public/icon.png">
     <%= csrf_meta_tags %>

data/app/views/masks/server/application/_person.html.erb

@@ -11,7 +11,7 @@
       <span class="person-sub">
         <%= details.join(" · ") %>
         <% if actor.email_unconfirmed? %>
-          <span class="person-note"><%= t("application.person.unconfirmed") %></span>
+          <span class="person-note"><%= local_assigns[:unconfirmed] || t("application.person.unconfirmed") %></span>
         <% end %>
       </span>
     <% end %>