masks-server 0.7.0 → 0.9.0

data/app/models/masks/server/client.rb

@@ -26,6 +26,7 @@ module Masks
       CHALLENGE_METHODS = %w[S256].freeze
       LOOPBACK = %w[localhost 127.0.0.1 ::1].freeze
       DEFAULT_SCOPES = Scopes::STANDARD
+      MACHINE_ACCESS_LIFETIME = 10.minutes
       LINKS = %i[client_uri tos_uri policy_uri].freeze
       METADATA_URIS = (LINKS + [ :logo_uri ]).freeze
       URI_LIMIT = 2048
@@ -47,12 +48,15 @@ module Masks
       ].freeze
 
       class ScopesUnavailable < StandardError; end
+      class EnrollmentRefused < StandardError; end
 
       has_many :tokens, dependent: :destroy
       has_many :consents, dependent: :destroy
       has_many :delegations, dependent: :destroy
       has_many :saml_participations, dependent: :delete_all
       has_many :namespaces, -> { order(:name) }, dependent: :nullify
+      has_many :enrolled, class_name: "Client", foreign_key: :enrolled_by_id, inverse_of: :enrolled_by,
+                          dependent: :nullify
       has_one :logo, class_name: "ClientLogo", dependent: :delete
 
       validate :allowed_groups_are_named
@@ -86,8 +90,10 @@ module Masks
       normalizes(*METADATA_URIS, with: ->(value) { value.to_s.strip.presence })
 
       after_commit :refresh_logo!, on: %i[create update], if: :saved_change_to_logo_uri?
+      after_update :archived!, if: -> { saved_change_to_archived_at? && archived? }
 
       belongs_to :approved_by, class_name: "Actor", optional: true
+      belongs_to :enrolled_by, class_name: "Client", optional: true, inverse_of: :enrolled
       belongs_to :sign_in_policy, optional: true
 
       scope :approved, -> { where.not(approved_at: nil) }
@@ -117,7 +123,7 @@ module Masks
           {
             name: handshake.name,
             redirect_uris: handshake.redirect_uris,
-            post_logout_redirect_uris: [ handshake.return_to ].compact,
+            post_logout_redirect_uris: [ handshake.post_logout_redirect_uri ].compact,
             resources: [ handshake.resource ],
             allowed_scopes: Scopes.join(handshake.scopes),
             grant_types: handshake.grant_types,
@@ -125,6 +131,7 @@ module Masks
             token_endpoint_auth_method: handshake.auth_method,
             backchannel_logout_uri: handshake.backchannel_logout_uri,
             client_uri: handshake.origin,
+            handshake_return_to: handshake.return_to,
             dynamic: false
           }
         end
@@ -132,7 +139,7 @@ module Masks
         def approved_for(resource)
           return nil if resource.blank?
 
-          active.approved.where("resources @> ?", [ resource.to_s ].to_json).first
+          active.approved.where(enrolled_by_id: nil).where("resources @> ?", [ resource.to_s ].to_json).first
         end
 
         def register!(metadata)
@@ -163,12 +170,48 @@ module Masks
             name: held[:name] || name,
             grant_types: grant_types,
             response_types: held[:response_types].presence || response_types_for(grant_types),
-            allowed_scopes: Scopes.join(bounded(metadata.to_h.stringify_keys["scope"].presence ||
-                                                Current.tenant&.dynamic_client_ceiling || DEFAULT_SCOPES)),
+            allowed_scopes: Scopes.join(declared_scopes(metadata)),
             dynamic: true
           )
         end
 
+        def enroll!(token, metadata)
+          app = token.client
+          app&.lock!
+          refusal = app&.enrollment_refusal(token.scope_list)
+
+          raise EnrollmentRefused, refusal || "the app that issued this enrollment token is gone" if app.nil? || refusal
+
+          held = metadata.to_h.stringify_keys
+
+          raise EnrollmentRefused, "jwks_uri is not accepted here; register the public keys as jwks" if held["jwks_uri"].present?
+          raise EnrollmentRefused, "jwks is required: the machine signs in with its own key" if held["jwks"].blank?
+
+          new(
+            client_id: SecureRandom.uuid,
+            name: held["client_name"].to_s.strip.presence || token.held("name") || "A machine",
+            jwks: held["jwks"],
+            token_endpoint_auth_method: PRIVATE_KEY_JWT,
+            grant_types: [ CLIENT_CREDENTIALS ],
+            response_types: [],
+            dpop_bound_access_tokens: true,
+            resources: app.resources,
+            allowed_scopes: Scopes.join(token.scope_list),
+            application_type: "native",
+            subject_type: Subjects::PUBLIC,
+            enrolled_by: app,
+            access_token_lifetime: MACHINE_ACCESS_LIFETIME.to_i,
+            approved_at: Time.current,
+            dynamic: false
+          ).issue_credentials!
+        end
+
+        def declared_scopes(metadata)
+          declared = metadata.to_h.stringify_keys["scope"]
+
+          Scopes.list(declared).empty? ? [] : bounded(declared)
+        end
+
         def bounded(requested)
           reserved = Scopes.reserved(requested) + Scopes.list(requested).select { |s| Scopes.prefix?(s) }
 
@@ -216,6 +259,38 @@ module Masks
         end
       end
 
+      def enrollment_refusal(scopes)
+        return "an archived client enrolls nothing" if archived?
+        return "a public client enrolls nothing" if public?
+        return "only an approved client enrolls machines" unless approved?
+        return "a client enrolls machines only after it claims a namespace" if namespaces.empty?
+        return "a scope is required" if Scopes.list(scopes).empty?
+
+        held = namespaces.map(&:name)
+        outside = Scopes.list(scopes).select do |scope|
+          Scopes.prefix?(scope) || scope.start_with?(Scopes::NAMESPACE) || !Scopes.covered?(held, scope)
+        end
+
+        "#{Scopes.join(outside)} is outside #{Scopes.join(held)}" if outside.any?
+      end
+
+      def enrolled?
+        enrolled_by_id.present?
+      end
+
+      def unenroll!
+        transaction do
+          revoked = end_tokens!
+          update!(archived_at: Time.current) unless archived?
+          revoked
+        end
+      end
+
+      def end_tokens!
+        now = Time.current
+        tokens.where(consumed_at: nil).update_all(consumed_at: now, updated_at: now)
+      end
+
       def public?
         token_endpoint_auth_method == "none"
       end
@@ -311,7 +386,7 @@ module Masks
       end
 
       def redirect_uri?(candidate)
-        redirect_uris.include?(candidate.to_s)
+        redirect_uris.include?(candidate.to_s) || redirect_uris.any? { |registered| same_loopback?(registered, candidate.to_s) }
       end
 
       def grants?(grant_type)
@@ -355,7 +430,11 @@ module Masks
       end
 
       def scope_list
-        Scopes.union(required_scopes, allowed_scopes)
+        Scopes.union(required_scopes, offered_scopes)
+      end
+
+      def follows_registration?
+        dynamic? && Scopes.list(allowed_scopes).empty?
       end
 
       def access_lifetime
@@ -373,7 +452,19 @@ module Masks
       def permitted_scopes(requested)
         return scope_list if Scopes.list(requested).empty?
 
-        Scopes.union(required_scopes, Scopes.granted(requested, allowed_scopes))
+        return Scopes.union(required_scopes, unreserved(requested)) if open_to_anything?
+
+        Scopes.union(required_scopes, Scopes.granted(requested, offered_scopes))
+      end
+
+      def refused_scopes(requested)
+        Scopes.list(requested) - permitted_scopes(requested)
+      end
+
+      def offered_scopes
+        return Scopes.list(allowed_scopes) unless follows_registration?
+
+        Current.tenant&.dynamic_client_ceiling || DEFAULT_SCOPES
       end
 
       def metadata
@@ -412,6 +503,17 @@ module Masks
 
       private
 
+        def archived!
+          end_tokens!
+
+          machines = enrolled.active.pluck(:id)
+          return if machines.empty?
+
+          now = Time.current
+          Client.where(id: machines).update_all(archived_at: archived_at, updated_at: now)
+          Token.where(client_id: machines, consumed_at: nil).update_all(consumed_at: now, updated_at: now)
+        end
+
         def allowed_groups_are_named
           unknown = allowed_groups.grep_v(ALLOWED_GROUP)
 
@@ -464,6 +566,24 @@ module Masks
           self.class.loopback?(uri)
         end
 
+        def open_to_anything?
+          follows_registration? && Current.tenant&.dynamic_registration == Tenant::REGISTRATION_ANYTHING
+        end
+
+        def unreserved(requested)
+          Scopes.list(requested).reject { |scope| Scopes.prefix?(scope) || Scopes.reserved(scope).any? }
+        end
+
+        def same_loopback?(registered, candidate)
+          held = URI.parse(registered)
+          asked = URI.parse(candidate)
+
+          [ held, asked ].all? { |uri| uri.instance_of?(URI::HTTP) && LOOPBACK.include?(uri.hostname) && uri.userinfo.nil? && uri.fragment.nil? } &&
+            held.hostname == asked.hostname && held.path == asked.path && held.query == asked.query
+        rescue URI::InvalidURIError
+          false
+        end
+
         def grant_types_are_known
           unknown = grant_types - GRANT_TYPES
           errors.add(:grant_types, "not supported: #{unknown.join(', ')}") if unknown.any?

data/app/models/masks/server/client_keys.rb

@@ -9,6 +9,8 @@ module Masks
       SECRET = %w[d p q dp dq qi k].freeze
       ALGORITHMS = %w[RS256 RS384 RS512 PS256 PS384 PS512 ES256 ES384 ES512].freeze
       KINDS = %w[RSA EC].freeze
+      CURVES = %w[P-256 P-384 P-521].freeze
+      SHORTEST_RSA = 2048
       LEEWAY = 30
       LONGEST = 1.hour
 
@@ -23,8 +25,11 @@ module Masks
             raise Refused, "every key must be a JSON object" unless key.is_a?(Hash)
             raise Refused, "#{key['kty'].presence || 'that'} is not a kind of key a client signs with" unless KINDS.include?(key["kty"])
             raise Refused, "a client's keys must be public" if key.keys.any? { |field| SECRET.include?(field.to_s) }
+            raise Refused, "#{key['crv'].presence || 'that'} is not a curve a client signs with" if key["kty"] == "EC" && !CURVES.include?(key["crv"])
 
-            JWT::JWK.new(key).verify_key
+            verified = JWT::JWK.new(key).verify_key
+
+            raise Refused, "an RSA key must be at least #{SHORTEST_RSA} bits" if verified.is_a?(OpenSSL::PKey::RSA) && verified.n.num_bits < SHORTEST_RSA
           end
 
           held

data/app/models/masks/server/enrollment_token.rb

@@ -0,0 +1,54 @@
+module Masks
+  module Server
+    class EnrollmentToken < Token
+      SHORTEST = 1.minute
+      LONGEST = 1.hour
+
+      class << self
+        def lifetime
+          15.minutes
+        end
+
+        def issue!(client, scope:, name: nil, expires_in: nil)
+          scopes = Scopes.list(scope)
+          refusal = client.enrollment_refusal(scopes)
+
+          raise Client::EnrollmentRefused, refusal if refusal
+
+          mint!(
+            client: client,
+            scopes: Scopes.join(scopes),
+            audience: client.resources,
+            payload: { "name" => name.to_s.strip.presence }.compact,
+            expires_at: lasting(expires_in).from_now
+          )
+        end
+
+        def redeem!(secret, metadata)
+          transaction(requires_new: true) do
+            token = claim(secret)
+
+            next nil if token.nil?
+
+            Client.enroll!(token, metadata)
+          end
+        end
+
+        private
+
+          def lasting(expires_in)
+            return lifetime if expires_in.blank?
+
+            seconds = Integer(expires_in.to_s, 10)
+
+            raise ArgumentError unless seconds.between?(SHORTEST.to_i, LONGEST.to_i)
+
+            seconds.seconds
+          rescue ArgumentError
+            raise Client::EnrollmentRefused,
+                  "expires_in must be between #{SHORTEST.to_i} and #{LONGEST.to_i} seconds"
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/event.rb

@@ -106,6 +106,9 @@ module Masks
       CLIENT_RESTORED = "client.restored".freeze
       CLIENT_SECRET_ROTATED = "client.secret_rotated".freeze
       CLIENT_LOGO_REFUSED = "client.logo_refused".freeze
+      CLIENT_ENROLLMENT_ISSUED = "client.enrollment_issued".freeze
+      CLIENT_ENROLLED = "client.enrolled".freeze
+      CLIENT_UNENROLLED = "client.unenrolled".freeze
 
       TOKEN_REVOKED = "token.revoked".freeze
       SAML_ASSERTED = "saml.asserted".freeze

data/app/models/masks/server/handshake.rb

@@ -4,7 +4,7 @@ module Masks
       GRANT_TYPES = %w[authorization_code refresh_token].freeze
 
       attr_reader :name, :redirect_uris, :resource, :scopes, :return_to, :state, :auth_method,
-                  :backchannel_logout_uri
+                  :backchannel_logout_uri, :post_logout_redirect_uri
 
       class << self
         def from_request(request)
@@ -19,7 +19,8 @@ module Masks
             return_to: params["return_to"],
             state: params["state"],
             auth_method: params["token_endpoint_auth_method"],
-            backchannel_logout_uri: params["backchannel_logout_uri"]
+            backchannel_logout_uri: params["backchannel_logout_uri"],
+            post_logout_redirect_uri: params["post_logout_redirect_uri"]
           )
         end
 
@@ -36,7 +37,8 @@ module Masks
             return_to: row.redirect_uri,
             state: held["state"],
             auth_method: held["auth_method"],
-            backchannel_logout_uri: held["backchannel_logout_uri"]
+            backchannel_logout_uri: held["backchannel_logout_uri"],
+            post_logout_redirect_uri: held["post_logout_redirect_uri"]
           )
         end
       end
@@ -54,7 +56,8 @@ module Masks
           "state" => state,
           "redirect_uris" => redirect_uris.sort,
           "auth_method" => auth_method,
-          "backchannel_logout_uri" => backchannel_logout_uri
+          "backchannel_logout_uri" => backchannel_logout_uri,
+          "post_logout_redirect_uri" => post_logout_redirect_uri
         }.compact
       end
 
@@ -73,12 +76,14 @@ module Masks
 
         pairs << [ "state", state ] if state
         pairs << [ "backchannel_logout_uri", backchannel_logout_uri ] if backchannel_logout_uri
+        pairs << [ "post_logout_redirect_uri", post_logout_redirect_uri ] if post_logout_redirect_uri
         redirect_uris.each { |uri| pairs << [ "redirect_uris", uri ] }
         pairs
       end
 
       def initialize(name: nil, redirect_uris: nil, resource: nil, scopes: nil,
-                     return_to: nil, state: nil, auth_method: nil, backchannel_logout_uri: nil)
+                     return_to: nil, state: nil, auth_method: nil, backchannel_logout_uri: nil,
+                     post_logout_redirect_uri: nil)
         @name = name.to_s.strip.presence || "An application"
         @redirect_uris = Array(redirect_uris).map(&:to_s).reject(&:empty?).uniq
         @resource = resource.to_s
@@ -87,6 +92,7 @@ module Masks
         @state = state.presence
         @auth_method = auth_method.to_s.presence || Client::DEFAULT_AUTH_METHOD
         @backchannel_logout_uri = backchannel_logout_uri.to_s.strip.presence
+        @post_logout_redirect_uri = post_logout_redirect_uri.to_s.strip.presence
       end
 
       def origin
@@ -134,7 +140,7 @@ module Masks
             return "token_endpoint_auth_method must be one of #{Client::AUTH_METHODS.join(', ')}"
           end
 
-          elsewhere = ([ return_to ] + redirect_uris + Array(backchannel_logout_uri))
+          elsewhere = ([ return_to ] + redirect_uris + Array(backchannel_logout_uri) + Array(post_logout_redirect_uri))
             .reject { |uri| origin_of(uri) == origin }
           return "everything must share the origin #{origin}: #{elsewhere.join(', ')}" if elsewhere.any?
 

data/app/models/masks/server/issuer.rb

@@ -163,6 +163,7 @@ module Masks
           "pushed_authorization_request_endpoint" => "#{url}/par",
           "device_authorization_endpoint" => "#{url}/device_authorization",
           "handshake_endpoint" => "#{url}/handshake",
+          "enrollment_endpoint" => "#{url}/enrollments",
           "masks_protocol_version" => Masks::PROTOCOL_VERSION,
           "revocation_endpoint" => "#{url}/revoke",
           "introspection_endpoint" => "#{url}/introspect",

data/app/models/masks/server/login.rb

@@ -416,8 +416,7 @@ module Masks
             "rid" => rid,
             "docs" => ::Rails.configuration.masks.docs_url,
             "actor" => actor && { "nickname" => actor.nickname, "name" => actor.name,
-                                  "identifier" => actor.identifier },
-            "person" => person_json,
+                                  "identifier" => actor.identifier, "card" => card_json },
             "client" => client_json,
             "tenant" => tenant && {
               "name" => tenant.name, "logo" => tenant.logo_url
@@ -429,10 +428,8 @@ module Masks
           answering.reduce(base) { |json, state| state.enabled? ? json.merge(state.as_json) : json }
         end
 
-        def person_json
-          return nil if actor.nil? || authenticated_at.nil?
-
-          actor.person_json
+        def card_json
+          actor.card_json if authenticated_at
         end
 
         def forget_vanished_actor!

data/app/models/masks/server/namespace.rb

@@ -17,12 +17,15 @@ module Masks
           Scopes.list(scopes).select { |scope| Scopes.prefix?(scope) && !scope.start_with?(Scopes::NAMESPACE) }
         end
 
-        def named(scopes)
-          where(name: prefixes(scopes))
+        def overlapping(scopes)
+          names = prefixes(scopes)
+          return none if names.empty?
+
+          where(names.map { "(starts_with(name, ?) OR starts_with(?, name))" }.join(" OR "), *names.flat_map { |name| [ name, name ] })
         end
 
         def taken(handshake)
-          named(handshake.scopes).where.not(resource: handshake.resource.to_s)
+          overlapping(handshake.scopes).where.not(resource: handshake.resource.to_s)
         end
 
         def refusal(handshake)

data/app/models/masks/server/pending_handshake.rb

@@ -19,7 +19,8 @@ module Masks
             "redirect_uris" => handshake.redirect_uris,
             "state" => handshake.state,
             "auth_method" => handshake.auth_method,
-            "backchannel_logout_uri" => handshake.backchannel_logout_uri
+            "backchannel_logout_uri" => handshake.backchannel_logout_uri,
+            "post_logout_redirect_uri" => handshake.post_logout_redirect_uri
           }.compact
         )
       end

data/app/models/masks/server/replay.rb

@@ -1,10 +1,28 @@
 module Masks
   module Server
-    module Replay
-      def self.first?(kind, id, expires_in:, within: nil)
-        key = [ kind, Current.tenant&.id, within, Digest::SHA256.hexdigest(id.to_s) ].compact.join(":")
+    class Replay < ApplicationRecord
+      include TenantScoped
 
-        ::Rails.cache.write(key, true, expires_in: expires_in, unless_exist: true)
+      class << self
+        def first?(kind, id, expires_in:, within: nil)
+          now = Time.current
+          claimed = connection.exec_query(sanitize_sql_array([ <<~SQL, Current.tenant.id, kind.to_s, digest(within, id), now + expires_in, now, now ]), "Replay")
+            INSERT INTO replays (tenant_id, kind, digest, expires_at, created_at)
+            VALUES (?, ?, ?, ?, ?)
+            ON CONFLICT (tenant_id, kind, digest) DO UPDATE
+              SET expires_at = EXCLUDED.expires_at, created_at = EXCLUDED.created_at
+              WHERE replays.expires_at <= ?
+            RETURNING id
+          SQL
+
+          claimed.rows.any?
+        end
+
+        private
+
+          def digest(within, id)
+            Digest::SHA256.hexdigest([ within&.to_s, id.to_s ].to_json)
+          end
       end
     end
   end

data/app/models/masks/server/session.rb

@@ -23,7 +23,7 @@ module Masks
 
       class << self
         def start!(actor:, device: nil, user_agent: nil, ip_address: nil, amr: [], origin: nil, policy: nil,
-                   first_factor: {})
+                   first_factor: {}, authenticated_at: nil)
           secret = SecureRandom.urlsafe_base64(48)
           lifetime = policy&.session_lifetime&.seconds || LIFETIME
           now = Time.current
@@ -36,7 +36,7 @@ module Masks
             user_agent: user_agent,
             ip_address: ip_address,
             origin: origin.presence || Current.origin,
-            authenticated_at: now,
+            authenticated_at: authenticated_at || now,
             last_seen_at: now,
             amr: Array(amr),
             first_factor: first_factor["factor"],
@@ -71,10 +71,12 @@ module Masks
         { "factor" => first_factor, "provider_id" => provider_id }.compact
       end
 
-      def first_factored!(held)
-        return if held["factor"].blank? || held == first_factored_by
+      def first_factored!(held, at: nil)
+        changes = {}
+        changes[:authenticated_at] = at if at.present? && (authenticated_at.nil? || at > authenticated_at)
+        changes.merge!(first_factor: held["factor"], provider_id: held["provider_id"]) if held["factor"].present? && held != first_factored_by
 
-        update!(first_factor: held["factor"], provider_id: held["provider_id"])
+        update!(changes) if changes.any?
       end
 
       def bound?

data/app/models/masks/server/token.rb

@@ -16,6 +16,7 @@ module Masks
         "password_reset" => "PasswordReset",
         "confirmation" => "ConfirmationCode",
         "initial_access" => "InitialAccessToken",
+        "enrollment" => "EnrollmentToken",
         "request" => "PendingRequest",
         "login" => "PendingLogin",
         "pushed" => "PushedRequest",

data/app/policies/masks/server/exchange_policy.rb

@@ -85,7 +85,7 @@ module Masks
         end
 
         def scopes_stay_within_the_client
-          beyond = Scopes.refused(client.scope_list, requested_scopes)
+          beyond = client.refused_scopes(requested_scopes)
 
           deny!("invalid_scope", "this client may not hold #{beyond.join(', ')}") if beyond.any?
         end

data/app/policies/masks/server/grant_checks.rb

@@ -8,7 +8,7 @@ module Masks
         end
 
         def scopes_are_permitted
-          refused = Scopes.refused(client.scope_list, requested_scopes)
+          refused = client.refused_scopes(requested_scopes)
 
           if refused.any?
             deny!("invalid_scope",

data/app/views/layouts/masks/server/manage.html.erb

@@ -1,11 +1,11 @@
 <!DOCTYPE html>
-<html lang="<%= Masks::Server::Locales.tag %>" data-theme="rose">
+<html lang="<%= Masks::Server::Locales.tag %>">
   <head>
     <title><%= content_for(:title) || "Manage #{Masks::Server::Current.tenant&.name}" %></title>
     <meta charset="utf-8">
     <meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
     <meta name="masks-root" content="<%= request.script_name %>">
-    <meta name="color-scheme" content="dark">
+    <meta name="color-scheme" content="light dark">
     <link rel="icon" href="/masks-public/favicon.svg" type="image/svg+xml">
     <link rel="apple-touch-icon" href="/masks-public/icon.png">
     <%= csrf_meta_tags %>

data/app/views/masks/server/account/_info.html.erb

@@ -4,7 +4,7 @@
   <div class="entries">
     <details class="entry" id="profile">
       <summary>
-        <span class="entry-icon"><%= account_icon(:person) %></span>
+        <span class="entry-icon"><%= account_icon(:actor) %></span>
         <span class="entry-label"><%= account_text("profile.heading") %></span>
         <span class="entry-state"><%= actor.name.presence || actor.nickname %></span>
         <span class="entry-mark" aria-hidden="true"></span>

data/app/views/masks/server/account/_organizations.html.erb

@@ -72,7 +72,7 @@
 
           <% if own.owner? %>
             <p class="item-meta">
-              <%= account_text("organizations.people", count: joined) %>
+              <%= account_text("organizations.member_count", count: joined) %>
               · <%= account_text("organizations.owners", count: owners) %>
               <% if waiting.positive? %>
                 · <%= account_text("organizations.waiting_count", count: waiting) %>
@@ -81,8 +81,8 @@
 
             <div class="items">
               <% members.each do |member| %>
-                <% person = member.actor %>
-                <% yourself = person.id == own.actor_id %>
+                <% actor = member.actor %>
+                <% yourself = actor.id == own.actor_id %>
                 <% label = Masks::Server::Members.label(member) || account_text("organizations.invited_by_manager") %>
                 <div class="item item-member">
                   <span class="item-name">
@@ -111,7 +111,7 @@
                                       class: "control control-sm", id: "role-#{organization.key}-#{member.id}",
                                       disabled: yourself && alone,
                                       data: { autosubmit: true },
-                                      aria: { label: account_text("organizations.role_of", person: label) } %>
+                                      aria: { label: account_text("organizations.role_of", name: label) } %>
                       <button type="submit" class="action action-quiet action-sm" data-autosubmitted <%= "disabled" if yourself && alone %>>
                         <%= account_text("organizations.set_role") %>
                       </button>

data/app/views/masks/server/application/_actor.html.erb

@@ -0,0 +1,27 @@
+<% sign_out = local_assigns.fetch(:sign_out, false) %>
+<% details = actor.display_details %>
+
+<div class="actor">
+  <%= avatar_tag actor, size: 44, class: "actor-avatar" %>
+
+  <div class="actor-who">
+    <span class="actor-name"><%= actor.display_name %></span>
+
+    <% if details.any? || actor.email_unconfirmed? %>
+      <span class="actor-sub">
+        <%= details.join(" · ") %>
+        <% if actor.email_unconfirmed? %>
+          <span class="actor-note"><%= local_assigns[:unconfirmed] || t("application.actor.unconfirmed") %></span>
+        <% end %>
+      </span>
+    <% end %>
+
+    <% if actor.manages? %>
+      <span class="actor-role"><%= t("application.actor.manager") %></span>
+    <% end %>
+  </div>
+
+  <% if sign_out %>
+    <%= button_to t("application.actor.sign_out"), logout_path, class: "textlink", form_class: "signout" %>
+  <% end %>
+</div>

data/app/views/masks/server/handshakes/refused.html.erb

@@ -6,7 +6,7 @@
 <h1 class="prompt-title"><%= t(".title") %></h1>
 
 <% if current_actor %>
-  <%= render "masks/server/application/person", actor: current_actor, sign_out: true %>
+  <%= render "masks/server/application/actor", actor: current_actor, sign_out: true %>
 <% end %>
 
 <p class="said"><%= @description %></p>