masks-server 0.7.0 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 670bf543e143915a6be6c9ca44965b2a66315bf479d60ec190b2cbc53fe939bb
-  data.tar.gz: 8b1fabb6b7597f23802f81e07b966992a69cd9ba8bd03f070812729f246b66a6
+  metadata.gz: 36e33f34e755bbbb4470a5c55b920624f2042678b87c810ce614e86f9638a4df
+  data.tar.gz: 2bf178807ba578015922b44145ad0eb28454698adb877ac51b5059be57a35ca3
 SHA512:
-  metadata.gz: 96e59cfb63394b1fe6be72fcb2320c1ed401951ce6eb681600f405221eda392040f4d6f84a918641e9de5de236f563479e532c155c1fe015d5f0d53301d9f4d1
-  data.tar.gz: a5733b84f8c14b7bc86e9b3ca2099b471fad489ac53486a71386f92e9fb10076d45c977387672236d1db039dc06218547fd3e214e65a533d322b3efc80f19bdb
+  metadata.gz: 3d32dd6592c56c0132971c1f322ca90b2a31df6832c0b9fe33d5c41c7d5d7aab443b4c6b2fec0a9d3ac0635b22b6d86bbda1c451bd791fd3794e4776c1edd1c8
+  data.tar.gz: 59f5658c277590947cf74f3b8e57fe2d9d7b01f1a160bdc3bdbc3593f4aba9b9395b08255b866e54029f48aff6d9b7b1384daf9ab1b21b95f7468678a800fbcb

data/app/controllers/concerns/masks/server/client_authentication.rb

@@ -44,7 +44,7 @@ module Masks
         end
 
         def assertion_audiences
-          [ issuer.url, "#{issuer.url}/token", "#{issuer.url}#{request.path}" ].uniq
+          [ issuer.url, "#{issuer.url}/token", "#{issuer.url}#{request.path_info}" ].uniq
         end
 
         def presented_credentials

data/app/controllers/concerns/masks/server/resource_token.rb

@@ -19,7 +19,7 @@ module Masks
           answer = handler.call(request.env)
 
           return render_rack(answer) unless answer.first == 200
-          return refuse_token("a bearer token is required") if token.nil?
+          return ask_for_token if token.nil?
 
           yield token
         end
@@ -50,8 +50,11 @@ module Masks
 
         def decode(bearer)
           claims_in_token(bearer.access_token)
+        rescue JWT::ExpiredSignature
+          bearer.invalid_token!("that token has expired")
         rescue JWT::DecodeError => e
-          bearer.invalid_token!(e.message)
+          ::Rails.logger.info("masks: an access token was refused: #{e.message}")
+          bearer.invalid_token!("that token is not one this server signed")
         end
 
         def claims_in_token(secret)
@@ -96,7 +99,7 @@ module Masks
         end
 
         def proof_for(secret = nil)
-          Proof.read!(request, url: "#{issuer.url}#{request.path}", access_token: secret)
+          Proof.read!(request, url: "#{issuer.url}#{request.path_info}", access_token: secret)
         end
 
         def held_token(secret)
@@ -118,6 +121,12 @@ module Masks
           nil
         end
 
+        def ask_for_token
+          response.headers["WWW-Authenticate"] = %(Bearer realm="#{issuer.url}")
+
+          head :unauthorized
+        end
+
         def refuse_token(description)
           render_rack(
             Rack::OAuth2::Server::Resource::Bearer::Unauthorized.new(

data/app/controllers/masks/server/application_controller.rb

@@ -143,7 +143,7 @@ module Masks
           Current.device = device
         end
 
-        def sign_in(actor, amr: [], policy: nil, first_factor: {})
+        def sign_in(actor, amr: [], policy: nil, first_factor: {}, authenticated_at: nil)
           carried = session.to_hash.slice(REQUESTS, HANDSHAKES, "login", RETURN_TO)
           reset_session
           carried.each { |key, value| session[key] = value }
@@ -157,7 +157,8 @@ module Masks
             ip_address: request.remote_ip,
             amr: amr,
             policy: policy,
-            first_factor: first_factor
+            first_factor: first_factor,
+            authenticated_at: authenticated_at
           )
 
           cookies.encrypted[:masks_session] = {
@@ -301,17 +302,18 @@ module Masks
         end
 
         def settle!(login)
-          hold(login.actor, amr: login.amr, policy: login.policy, first_factor: login.first_factored_by)
+          hold(login.actor, amr: login.amr, policy: login.policy, first_factor: login.first_factored_by,
+                            authenticated_at: login.factored_at(:first_factor))
           forget_login
         end
 
-        def hold(actor, amr: [], policy: nil, first_factor: {})
+        def hold(actor, amr: [], policy: nil, first_factor: {}, authenticated_at: nil)
           return if actor.nil?
-          return current_session.first_factored!(first_factor) if current_session&.actor_id == actor.id
+          return current_session.first_factored!(first_factor, at: authenticated_at) if current_session&.actor_id == actor.id
 
           sign_out if current_session
 
-          sign_in(actor, amr: amr, policy: policy, first_factor: first_factor)
+          sign_in(actor, amr: amr, policy: policy, first_factor: first_factor, authenticated_at: authenticated_at)
         end
 
         def policy_denied(denial)

data/app/controllers/masks/server/authorize_controller.rb

@@ -63,7 +63,7 @@ module Masks
             req.bad_request!(:invalid_client, unknown_client(req.client_id)) if client.nil?
             req.invalid_request!("redirect_uri is required") if req.redirect_uri.blank?
 
-            req.verify_redirect_uri!(client.redirect_uris)
+            req.verify_redirect_uri!(client.redirect_uri?(req.redirect_uri) ? [ req.redirect_uri.to_s ] : client.redirect_uris)
             req.verified_redirect_uri = with_issuer(req.verified_redirect_uri)
             res.redirect_uri = req.verified_redirect_uri
 

data/app/controllers/masks/server/enrollments_controller.rb

@@ -0,0 +1,66 @@
+module Masks
+  module Server
+    class EnrollmentsController < ApplicationController
+      include TokenPresented
+
+      rate_limit to: 30, within: 1.minute,
+                 by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
+                 with: -> {
+                   render json: {
+                     "error" => "too_many_requests",
+                     "error_description" => "too many enrollment tokens asked for from this address"
+                   }, status: :too_many_requests
+                 }
+
+      before_action :no_store!
+
+      def create
+        client = authenticate_app!
+        token = EnrollmentToken.issue!(client, scope: params[:scope], name: params[:client_name],
+                                               expires_in: params[:expires_in])
+
+        Event.record!(Event::CLIENT_ENROLLMENT_ISSUED, client: client, scopes: token.scopes,
+                                                       name: token.held("name"), expires_at: token.expires_at.iso8601)
+
+        render json: {
+          "initial_access_token" => token.secret,
+          "expires_in" => token.expires_in,
+          "scope" => token.scopes
+        }, status: :created
+      rescue Client::EnrollmentRefused => e
+        render json: { "error" => "invalid_request", "error_description" => e.message }, status: :bad_request
+      end
+
+      def destroy
+        app = authenticate_app!
+        machine = app.enrolled.find_by(client_id: params[:machine].to_s)
+
+        return not_enrolled if machine.nil?
+
+        revoked = machine.unenroll!
+
+        Event.record!(Event::CLIENT_UNENROLLED, client: machine, name: machine.name, enrolled_by: app.client_id,
+                                                  revoked: revoked)
+
+        head :no_content
+      end
+
+      private
+
+        def authenticate_app!
+          client = authenticate_client!
+
+          client_refused!("a public client proves nothing about itself, so it enrolls and unenrolls nothing") if client.public?
+
+          client
+        end
+
+        def not_enrolled
+          render json: {
+            "error" => "invalid_request",
+            "error_description" => "that client was not enrolled by this app"
+          }, status: :not_found
+        end
+    end
+  end
+end

data/app/controllers/masks/server/introspections_controller.rb

@@ -13,7 +13,7 @@ module Masks
         client = authenticate_client!
         token = presented_token
 
-        return render json: INACTIVE unless token&.live? && entitled?(client, token)
+        return render json: INACTIVE unless token&.live? && !token.client&.archived? && entitled?(client, token)
 
         render json: described(token)
       end
@@ -22,7 +22,7 @@ module Masks
 
         def entitled?(client, token)
           return true if token.client_id == client.id
-          return false unless client.approved?
+          return false if client.enrolled? || !client.approved?
 
           (Array(token.audience) & Array(client.resources)).any?
         end

data/app/controllers/masks/server/logins_controller.rb

@@ -151,7 +151,8 @@ module Masks
           return unless login.actor
 
           if login.touched?(:first_factor)
-            sign_in(login.actor, amr: login.amr, policy: login.policy, first_factor: login.first_factored_by)
+            sign_in(login.actor, amr: login.amr, policy: login.policy, first_factor: login.first_factored_by,
+                                 authenticated_at: login.factored_at(:first_factor))
           elsif login.signed_in? && login.touched?(:second_factor)
             current_session.update!(amr: Array(current_session.amr) | login.amr)
           end

data/app/controllers/masks/server/registrations_controller.rb

@@ -14,6 +14,7 @@ module Masks
 
       before_action :no_store!
       before_action :require_registration_token, except: :create
+      before_action :refuse_enrolled, only: :update
 
       def create
         return redeem if bearer.present?
@@ -26,7 +27,7 @@ module Masks
         render json: issued(client), status: :created
       rescue ActiveRecord::RecordInvalid => e
         invalid_metadata(e.record.errors.full_messages.join("; "))
-      rescue Client::ScopesUnavailable => e
+      rescue Client::ScopesUnavailable, Client::EnrollmentRefused => e
         invalid_metadata(e.message)
       end
 
@@ -47,6 +48,8 @@ module Masks
       end
 
       def destroy
+        return unenroll if @client.enrolled?
+
         @client.update!(archived_at: Time.current)
 
         Event.record!(Event::CLIENT_ARCHIVED, client: @client, name: @client.name)
@@ -56,7 +59,27 @@ module Masks
 
       private
 
+        def unenroll
+          revoked = @client.unenroll!
+
+          Event.record!(Event::CLIENT_UNENROLLED, client: @client, name: @client.name,
+                                                  enrolled_by: @client.enrolled_by&.client_id, revoked: revoked)
+
+          head :no_content
+        end
+
+        def refuse_enrolled
+          return unless @client.enrolled?
+
+          render json: {
+            "error" => "access_denied",
+            "error_description" => "an enrolled machine is changed only by the app that enrolled it"
+          }, status: :forbidden
+        end
+
         def redeem
+          return enrolled(@enrolled) if (@enrolled = EnrollmentToken.redeem!(bearer, body))
+
           token = InitialAccessToken.claim(bearer)
 
           return unauthorized("that initial access token is not valid or has expired") if token&.client.nil?
@@ -64,6 +87,13 @@ module Masks
           render json: issued(token.issue!), status: :created
         end
 
+        def enrolled(client)
+          Event.record!(Event::CLIENT_ENROLLED, client: client, name: client.name,
+                                                enrolled_by: client.enrolled_by.client_id)
+
+          render json: issued(client), status: :created
+        end
+
         def bearer
           request.authorization.to_s[/\ABearer (\S+)\z/, 1]
         end
@@ -103,6 +133,12 @@ module Masks
           }, status: :bad_request
         end
 
+        def ask_for_token
+          response.headers["WWW-Authenticate"] = %(Bearer realm="#{issuer.url}")
+
+          head :unauthorized
+        end
+
         def issued(client)
           client.metadata.merge(
             "client_secret" => client.secret,
@@ -125,7 +161,9 @@ module Masks
         end
 
         def unauthorized(description)
-          response.headers["WWW-Authenticate"] = %(Bearer error="invalid_token")
+          return ask_for_token if bearer.blank?
+
+          response.headers["WWW-Authenticate"] = %(Bearer realm="#{issuer.url}", error="invalid_token")
 
           render json: {
             "error" => "invalid_token",

data/app/controllers/masks/server/scim/metadata_controller.rb

@@ -7,7 +7,7 @@ module Masks
         def service_provider_config
           scim({
             "schemas" => [ Scim::SERVICE_PROVIDER_CONFIG ],
-            "documentationUri" => "#{::Rails.configuration.masks.docs_url}/concepts/provisioning/",
+            "documentationUri" => "#{::Rails.configuration.masks.docs_url}/guides/sso-saml/#provisioning",
             "patch" => { "supported" => true },
             "bulk" => { "supported" => false, "maxOperations" => 0, "maxPayloadSize" => 0 },
             "filter" => { "supported" => true, "maxResults" => Scim::MAX_RESULTS },

data/app/controllers/masks/server/tokens_controller.rb

@@ -42,7 +42,7 @@ module Masks
           return @proof if defined?(@proof)
 
           @proof = if Proof.presented?(request)
-            Proof.read!(request, url: "#{issuer.url}#{request.path}")
+            Proof.read!(request, url: "#{issuer.url}#{request.path_info}")
           end
         end
 

data/app/graphql/masks/server/manage/mutations/add_app.rb

@@ -7,7 +7,7 @@ module Masks
 
           argument :preset, ID
           argument :base_url, String, description: "Where the app is served, such as https://grafana.example.com."
-          argument :name, String, required: false, description: "What people see. The preset's name when left out."
+          argument :name, String, required: false, description: "What people see."
           argument :slug, String, required: false,
                    description: "The name some apps put in their redirect URI, such as Gitea's authentication source."
 

data/app/graphql/masks/server/manage/types/client_type.rb

@@ -57,6 +57,10 @@ module Masks
           field :dynamic, Boolean, null: false
           field :approved_at, GraphQL::Types::ISO8601DateTime
           field :approved_by, ActorType
+          field :enrolled_by, ClientType,
+                description: "The app that enrolled this client as one of its machines. Archiving that app archives this client."
+          field :enrolled, [ ClientType ], null: false,
+                description: "The machines this app enrolled that are not archived."
           field :archived_at, GraphQL::Types::ISO8601DateTime
           field :secret_expires_at, GraphQL::Types::ISO8601DateTime
           field :created_at, GraphQL::Types::ISO8601DateTime, null: false
@@ -75,6 +79,10 @@ module Masks
             argument :limit, Integer, required: false
           end
 
+          def enrolled
+            object.enrolled.active.order(:name)
+          end
+
           def tokens(limit: nil)
             Masks::Server::Token.where(kind: TokenType::GRANTS, client_id: object.id)
                    .live

data/app/graphql/masks/server/manage/types/query_type.rb

@@ -169,6 +169,8 @@ module Masks
             argument :action, String, required: false
             argument :grave, Boolean, required: false
             argument :organization, ID, required: false
+            argument :since, GraphQL::Types::ISO8601DateTime, required: false,
+                                                               description: "Only events recorded at or after this time."
             argument :after_id, ID, required: false
             argument :limit, Integer, required: false
           end
@@ -180,6 +182,8 @@ module Masks
             argument :action, String, required: false
             argument :grave, Boolean, required: false
             argument :organization, ID, required: false
+            argument :since, GraphQL::Types::ISO8601DateTime, required: false,
+                                                               description: "Only events recorded at or after this time."
           end
 
           field :event_actions, [ EventActionType ], null: false
@@ -484,7 +488,7 @@ module Masks
               scope.where("name ILIKE :term OR client_id = :exact", term: term, exact: search.strip)
             end
 
-            def event_scope(actor: nil, client: nil, device: nil, action: nil, grave: false, organization: nil)
+            def event_scope(actor: nil, client: nil, device: nil, action: nil, grave: false, organization: nil, since: nil)
               subject = actor.present? ? Actor.find_by(uuid: actor) : nil
               group = organization.present? ? Masks::Server::Organization.find_by(key: organization) : nil
 
@@ -504,6 +508,7 @@ module Masks
               scope = scope.where(organization: group) if group
               scope = scope.where(action: action) if action.present?
               scope = scope.where(action: Masks::Server::Event::GRAVE) if grave
+              scope = scope.where(created_at: since..) if since
 
               scope
             end

data/app/helpers/masks/server/account_helper.rb

@@ -15,7 +15,7 @@ module Masks
         close: '<path d="M6.5 6.5l7 7M13.5 6.5l-7 7"/>',
         check: '<path d="m5.5 10.5 3 3 6-7"/>',
         organization: '<rect x="3.5" y="7" width="13" height="9.5" rx="1.5"/><path d="M7.5 7V4.5h5V7"/><path d="M3.5 11h13"/>',
-        person: '<circle cx="10" cy="7" r="3.25"/><path d="M4 16.5c.8-3 3.2-4.5 6-4.5s5.2 1.5 6 4.5"/>',
+        actor: '<circle cx="10" cy="7" r="3.25"/><path d="M4 16.5c.8-3 3.2-4.5 6-4.5s5.2 1.5 6 4.5"/>',
         authenticator: '<rect x="3" y="5.5" width="14" height="9" rx="2"/><path d="M6.5 10h.01M10 10h.01M13.5 10h.01"/>',
         backup_codes: '<path d="M5.5 3.5h9v13h-9z"/><path d="M8 7h4M8 10h4M8 13h4"/>',
         manage: '<path d="M10 2.5 3.5 5v5c0 3.4 2.7 6.2 6.5 7.5 3.8-1.3 6.5-4.1 6.5-7.5V5L10 2.5Z"/>'

data/app/helpers/masks/server/application_helper.rb

@@ -15,7 +15,6 @@ module Masks
           .auth-page {
             --signal: #{accent};
             --signal-ink: #{tenant.accent_ink};
-            --came: #{accent};
             --brass: #{accent};
             --ring: color-mix(in oklab, #{accent} 30%, transparent);
           }

data/app/helpers/masks/server/scopes_helper.rb

@@ -3,13 +3,41 @@ module Masks
     module ScopesHelper
       CONSEQUENTIAL = /(:write|:command|:exec|:delete|:admin)\z|\Aoffline_access\z|\Amasks:manage(:[a-z]+)?\z|\Amasks:delegate:./
 
+      SEEN = [
+        Scopes::OPENID, Scopes::PROFILE, Scopes::EMAIL,
+        Scopes::IDENTITIES, Scopes::ORGANIZATION, Scopes::GROUPS
+      ].freeze
+
       def consequential_scope?(scope)
         scope.to_s.match?(CONSEQUENTIAL)
       end
 
+      def heeded_scope?(scope)
+        scope == Scopes::DELEGATE || consequential_scope?(scope)
+      end
+
       def ranked_scopes(described)
         described.to_a.partition { |scope, _| consequential_scope?(scope) }
       end
+
+      def plain_scopes(described, areas: [])
+        held = { sees: [], heeds: [], also: [] }
+
+        described.to_a.each do |scope, description|
+          next if areas.include?(scope)
+
+          group =
+            if heeded_scope?(scope) then :heeds
+            elsif SEEN.include?(scope) then :sees
+            else :also
+            end
+
+          held[group] << [ scope, description ]
+        end
+
+        held[:sees].sort_by! { |scope, _| SEEN.index(scope) }
+        held
+      end
     end
   end
 end

data/app/jobs/masks/server/cleanup_job.rb

@@ -32,6 +32,7 @@ module Masks
           SigningKey.where.not(retired_at: nil).where(retired_at: ...cutoff).delete_all
           Event.where(created_at: ...tenant.event_retention.ago).in_batches(of: BATCH).delete_all
           Members.purge_lapsed!
+          Replay.where(expires_at: ...Time.current).in_batches(of: BATCH).delete_all
         end
 
         def sweep_tokens(cutoff)

data/app/models/masks/server/actor.rb

@@ -190,14 +190,14 @@ module Masks
         holds?(Scopes::MANAGE)
       end
 
-      def person_json
+      def card_json
         style = Avatars.held?(self) ? Avatars::PHOTO : Avatars::FALLBACK
 
         {
           "name" => display_name,
           "details" => display_details,
-          "note" => (I18n.t("application.person.unconfirmed") if email_unconfirmed?),
-          "role" => (I18n.t("application.person.manager") if manages?),
+          "note" => (I18n.t("application.actor.unconfirmed") if email_unconfirmed?),
+          "role" => (I18n.t("application.actor.manager") if manages?),
           "avatar" => Avatars.url(self, style, subject: uuid, size: 128)
         }
       end