masks-server 0.7.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 670bf543e143915a6be6c9ca44965b2a66315bf479d60ec190b2cbc53fe939bb
+  data.tar.gz: 8b1fabb6b7597f23802f81e07b966992a69cd9ba8bd03f070812729f246b66a6
+SHA512:
+  metadata.gz: 96e59cfb63394b1fe6be72fcb2320c1ed401951ce6eb681600f405221eda392040f4d6f84a918641e9de5de236f563479e532c155c1fe015d5f0d53301d9f4d1
+  data.tar.gz: a5733b84f8c14b7bc86e9b3ca2099b471fad489ac53486a71386f92e9fb10076d45c977387672236d1db039dc06218547fd3e214e65a533d322b3efc80f19bdb

data/app/controllers/concerns/masks/server/client_authentication.rb

@@ -0,0 +1,65 @@
+module Masks
+  module Server
+    module ClientAuthentication
+      extend ActiveSupport::Concern
+
+      private
+
+        def authenticated_client
+          assertion = params[:client_assertion].presence
+
+          return asserted_client(assertion) if assertion || params[:client_assertion_type].present?
+
+          id, secret = presented_credentials
+          client = Client.authenticating(id) if id.present?
+
+          client_refused!("no client is registered with that client_id") if client.nil?
+          client_refused!("this client authenticates with a signed assertion, not a secret") if client.asserts?
+
+          client_refused! unless client.authenticate_secret(secret)
+
+          client
+        end
+
+        def asserted_client(assertion)
+          client_refused!("client_assertion_type must be #{ClientAssertion::TYPE}") unless params[:client_assertion_type] == ClientAssertion::TYPE
+          client_refused!("client_assertion is required") if assertion.blank?
+          client_refused!("a client authenticates one way at a time") if request.authorization.to_s.start_with?("Basic ") || params[:client_secret].present?
+
+          named = ClientAssertion.issuer_of(assertion)
+          id = params[:client_id].presence || named
+
+          client_refused!("client_id does not match the client assertion") if params[:client_id].present? && named != params[:client_id]
+
+          client = Client.authenticating(id) if id.present?
+
+          client_refused!("no client is registered with that client_id") if client.nil?
+          client_refused!("this client is not registered to authenticate with a signed assertion") unless client.asserts?
+
+          ClientAssertion.new(assertion, client: client, audiences: assertion_audiences).verify!
+
+          client
+        rescue ClientAssertion::Refused => e
+          client_refused!(e.message)
+        end
+
+        def assertion_audiences
+          [ issuer.url, "#{issuer.url}/token", "#{issuer.url}#{request.path}" ].uniq
+        end
+
+        def presented_credentials
+          header = request.authorization.to_s
+
+          if header.start_with?("Basic ")
+            Base64.decode64(header.split(" ", 2).last.to_s).split(":", 2).map { |p| CGI.unescape(p.to_s) }
+          else
+            [ params[:client_id], params[:client_secret] ]
+          end
+        end
+
+        def client_refused!(description = "client authentication failed")
+          raise Policy::Denied.new("invalid_client", description, status: :unauthorized)
+        end
+    end
+  end
+end

data/app/controllers/concerns/masks/server/holds_login.rb

@@ -0,0 +1,49 @@
+module Masks
+  module Server
+    module HoldsLogin
+      extend ActiveSupport::Concern
+
+      LOGIN = "login".freeze
+
+      included do
+        after_action :keep_login
+      end
+
+      private
+
+        def login_store
+          return @login_store if defined?(@login_store)
+
+          @login_secret = session[LOGIN]
+          @pending_login = PendingLogin.redeem(@login_secret)
+          @login_store = @pending_login ? @pending_login.store : {}
+        end
+
+        def replace_login(held)
+          login_store.replace(held)
+        end
+
+        def forget_login
+          login_store
+          @login_store = {}
+          keep_login
+        end
+
+        def keep_login
+          return unless defined?(@login_store)
+
+          if @login_store.empty?
+            @pending_login&.destroy
+            @pending_login = nil
+            session.delete(LOGIN)
+          elsif @pending_login
+            @pending_login.keep!(@login_store)
+            session[LOGIN] = @login_secret
+          else
+            @pending_login = PendingLogin.open!(@login_store)
+            session[LOGIN] = @pending_login.secret
+          end
+        end
+    end
+  end
+end

data/app/controllers/concerns/masks/server/manage_endpoint.rb

@@ -0,0 +1,34 @@
+module Masks
+  module Server
+    module ManageEndpoint
+      extend ActiveSupport::Concern
+
+      included do
+        include RackOAuth2Endpoint
+        include ResourceToken
+
+        skip_forgery_protection
+      end
+
+      private
+
+        def with_manage_token
+          with_access_token(scope: ManageRoles::SCOPES) do |token|
+            actor = token.actor
+
+            next refuse_token("that token has no subject") if actor.nil?
+
+            roles = ManageRoles.held(token.scope_list) & ManageRoles.held(actor.scope_list)
+
+            next refuse_token("that actor no longer holds a manage role") if roles.empty?
+
+            unless token.audience.include?(issuer.manage_resource)
+              next refuse_token("that token was not issued for #{issuer.manage_resource}")
+            end
+
+            yield token, actor, roles
+          end
+        end
+    end
+  end
+end

data/app/controllers/concerns/masks/server/rack_oauth2_endpoint.rb

@@ -0,0 +1,45 @@
+module Masks
+  module Server
+    module RackOAuth2Endpoint
+      extend ActiveSupport::Concern
+
+      class Payload
+        def initialize(payload)
+          @payload = payload
+        end
+
+        def token_response
+          @payload
+        end
+      end
+
+      private
+
+        def render_rack(triple)
+          status, headers, body = triple
+
+          content = +""
+          body.each { |part| content << part }
+          body.close if body.respond_to?(:close)
+
+          location = headers["Location"] || headers["location"]
+
+          return redirect_to(location, allow_other_host: true, status: status) if location
+
+          headers.each do |key, value|
+            next if %w[content-length content-type].include?(key.downcase)
+
+            response.headers[key] = value
+          end
+
+          render plain: content,
+                 status: status,
+                 content_type: headers["Content-Type"] || headers["content-type"] || "application/json"
+        end
+
+        def repeated(name)
+          Array(Rack::Utils.parse_query(request.raw_post)[name]).map(&:to_s).reject(&:empty?)
+        end
+    end
+  end
+end

data/app/controllers/concerns/masks/server/resource_token.rb

@@ -0,0 +1,145 @@
+module Masks
+  module Server
+    module ResourceToken
+      extend ActiveSupport::Concern
+
+      class Refused < StandardError; end
+
+      private
+
+        def with_access_token(scope: nil, &block)
+          return with_bound_token(scope: scope, &block) if dpop_presented?
+
+          token = nil
+
+          handler = Rack::OAuth2::Server::Resource::Bearer.new(
+            ->(_env) { [ 200, {}, [] ] }, issuer.url
+          ) { |bearer| token = verify!(bearer, scope: scope) }
+
+          answer = handler.call(request.env)
+
+          return render_rack(answer) unless answer.first == 200
+          return refuse_token("a bearer token is required") if token.nil?
+
+          yield token
+        end
+
+        def verify!(bearer, scope: nil)
+          token = AccessToken.live.find_by(digest: decode(bearer)["jti"])
+
+          bearer.invalid_token!("that token has been revoked") if token.nil?
+
+          if token.bound?
+            bearer.invalid_token!("that token is bound to a key, and needs the proof that holds it")
+          end
+
+          unless carries?(token, scope)
+            bearer.insufficient_scope!("this token does not carry #{wanted(scope)}", scope: Scopes.join(scope))
+          end
+
+          token
+        end
+
+        def carries?(token, scope)
+          Scopes.list(scope).empty? || Scopes.list(scope).intersect?(token.scope_list)
+        end
+
+        def wanted(scope)
+          Scopes.list(scope).to_sentence(two_words_connector: " or ", last_word_connector: ", or ")
+        end
+
+        def decode(bearer)
+          claims_in_token(bearer.access_token)
+        rescue JWT::DecodeError => e
+          bearer.invalid_token!(e.message)
+        end
+
+        def claims_in_token(secret)
+          AccessToken.decode(secret, issuer: issuer, required: %w[iss sub exp jti])
+        end
+
+        def credentials
+          @credentials ||= request.authorization.to_s.split(" ", 2)
+        end
+
+        def dpop_presented?
+          credentials.first.to_s.casecmp?(Proof::SCHEME)
+        end
+
+        def with_bound_token(scope: nil)
+          token = bound_token!(credentials[1].to_s)
+
+          unless carries?(token, scope)
+            return refuse_proof("this token does not carry #{wanted(scope)}", error: "insufficient_scope", scope: Scopes.join(scope))
+          end
+
+          yield token
+        rescue Proof::Refused => refusal
+          refuse_proof(refusal.message, error: "invalid_dpop_proof")
+        rescue Refused => refusal
+          refuse_proof(refusal.message)
+        end
+
+        def bound_token!(secret)
+          raise Refused, "a token is required" if secret.blank?
+
+          token = held_token(secret)
+
+          raise Refused, "that token has been revoked" if token.nil?
+          raise Refused, "that token is not bound to a key" unless token.bound?
+
+          unless token.bound_to?(proof_for(secret))
+            raise Refused, "that proof was made with another key"
+          end
+
+          token
+        end
+
+        def proof_for(secret = nil)
+          Proof.read!(request, url: "#{issuer.url}#{request.path}", access_token: secret)
+        end
+
+        def held_token(secret)
+          AccessToken.live.find_by(digest: claims_in_token(secret)["jti"])
+        rescue JWT::DecodeError
+          nil
+        end
+
+        def presented_access_token
+          secret = credentials[1].to_s
+
+          return nil if secret.blank?
+          return bound_token!(secret) if dpop_presented?
+
+          token = held_token(secret)
+
+          token unless token.nil? || token.bound?
+        rescue Proof::Refused, Refused
+          nil
+        end
+
+        def refuse_token(description)
+          render_rack(
+            Rack::OAuth2::Server::Resource::Bearer::Unauthorized.new(
+              :invalid_token, description, realm: issuer.url
+            ).finish
+          )
+        end
+
+        def refuse_proof(description, error: "invalid_token", scope: nil)
+          held = [
+            %(realm="#{issuer.url}"),
+            %(error="#{error}"),
+            %(error_description="#{description.to_s.delete('"')}")
+          ]
+
+          held << %(scope="#{scope}") if scope.present?
+          held << %(algs="#{Proof::ALGORITHMS.join(' ')}")
+
+          response.headers["WWW-Authenticate"] = "#{Proof::SCHEME} #{held.join(', ')}"
+
+          head(error == "insufficient_scope" ? :forbidden : :unauthorized)
+        end
+    end
+  end
+end

data/app/controllers/concerns/masks/server/saml_farewells.rb

@@ -0,0 +1,53 @@
+module Masks
+  module Server
+    module SamlFarewells
+      extend ActiveSupport::Concern
+
+      private
+
+        def farewell(departing, finish:)
+          proceed(SamlIdentity::Farewells.new(departing.map(&:id), finish))
+        end
+
+        def proceed(farewells)
+          sign_off = farewells.advance(issuer)
+
+          return post_saml(sign_off.client, sign_off.destination, "SAMLRequest", sign_off.encoded, leaving: true) if sign_off
+
+          finish_farewells(farewells.finish)
+        end
+
+        def finish_farewells(held)
+          return redirect_to(held["redirect"], allow_other_host: true) if held["redirect"]
+
+          client = Client.speaking(SamlIdentity::PROTOCOL).find_by(client_id: held["client_id"])
+
+          return redirect_to(login_path) if client.nil? || client.saml_slo_url.blank?
+
+          answer = SamlIdentity::Response.new(
+            issuer: issuer, client: client, destination: client.saml_slo_url, in_response_to: held["in_response_to"]
+          )
+
+          encoded = held["known"] ? answer.logout : answer.logout(SamlIdentity::REQUESTER, SamlIdentity::UNKNOWN_PRINCIPAL, "nobody by that NameID is signed in to it here")
+
+          post_saml(client, client.saml_slo_url, "SAMLResponse", encoded, relay_state: held["relay_state"], leaving: true)
+        end
+
+        def post_saml(client, destination, field, encoded, relay_state: nil, leaving: false)
+          @client = client
+          @destination = destination
+          @saml_field = field
+          @saml_message = encoded
+          @relay_state = relay_state
+          @leaving = leaving
+          @script_nonce = SecureRandom.base64(16)
+
+          response.headers["Content-Security-Policy"] =
+            "default-src 'self'; script-src 'nonce-#{@script_nonce}'; frame-ancestors 'none'"
+          response.headers["Cache-Control"] = "no-store"
+
+          render "masks/server/saml/post"
+        end
+    end
+  end
+end

data/app/controllers/concerns/masks/server/scim_endpoint.rb

@@ -0,0 +1,100 @@
+module Masks
+  module Server
+    module ScimEndpoint
+      extend ActiveSupport::Concern
+
+      included do
+        include ResourceToken
+
+        skip_forgery_protection
+
+        rate_limit to: 600, within: 1.minute,
+                   by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
+                   with: -> { scim_error(Scim::Error.new(:too_many_requests, "too many provisioning requests from this address")) }
+
+        rescue_from Scim::Error, with: :scim_error
+        before_action :require_provisioner
+      end
+
+      private
+
+        def require_provisioner
+          scheme, secret = credentials
+
+          raise Scim::Error.new(:unauthorized, "a bearer token is required") unless scheme.to_s.casecmp?("Bearer") && secret.present?
+
+          @provisioner = provisioning_token(secret) || scim_access_token(secret)
+
+          return if @provisioner
+
+          raise Scim::Error.new(:unauthorized, "that token is not one this tenant provisions with")
+        end
+
+        def provisioning_token(secret)
+          ProvisioningToken.redeem(secret)&.tap(&:used!)
+        end
+
+        def scim_access_token(secret)
+          token = held_token(secret)
+
+          return nil unless token && !token.bound? && token.scope_list.include?(Scopes::SCIM) && token.audience.include?(scim_base)
+
+          token if provisions?(token.actor || token.client)
+        end
+
+        def provisions?(holder)
+          return false if holder.nil? || (holder.respond_to?(:suspended?) && holder.suspended?)
+
+          holder.permitted_scopes(Scopes::SCIM).include?(Scopes::SCIM)
+        end
+
+        def directory
+          @directory ||= Scim::Directory.for(@provisioner&.organization)
+        end
+
+        def scim_base
+          Scim.base(issuer)
+        end
+
+        def document
+          @document ||= begin
+            parsed = JSON.parse(request.raw_post.presence || "{}")
+
+            raise Scim::Error.new(:bad_request, "the body must be a JSON object", scim_type: "invalidSyntax") unless parsed.is_a?(Hash)
+
+            parsed
+          rescue JSON::ParserError
+            raise Scim::Error.new(:bad_request, "the body is not JSON", scim_type: "invalidSyntax")
+          end
+        end
+
+        def scim_page
+          start = [ params[:startIndex].to_i, 1 ].max
+          count = params[:count].present? ? params[:count].to_i.clamp(0, Scim::MAX_RESULTS) : Scim::DEFAULT_COUNT
+
+          [ start, count ]
+        end
+
+        def listed(resources, total: resources.size, start: 1)
+          { "schemas" => [ Scim::LIST ], "totalResults" => total, "startIndex" => start,
+            "itemsPerPage" => resources.size, "Resources" => resources }
+        end
+
+        def patch_document!
+          return if Array(document["schemas"]).include?(Scim::PATCH)
+
+          raise Scim::Error.new(:bad_request, "a PATCH names #{Scim::PATCH}", scim_type: "invalidSyntax")
+        end
+
+        def scim(body, status: :ok)
+          render json: body, status: status, content_type: Scim::MEDIA_TYPE
+        end
+
+        def scim_error(error)
+          response.headers["WWW-Authenticate"] = %(Bearer realm="#{scim_base}") if error.status == :unauthorized
+
+          scim(error.to_h, status: error.status)
+        end
+    end
+  end
+end

data/app/controllers/concerns/masks/server/serves_pictures.rb

@@ -0,0 +1,27 @@
+module Masks
+  module Server
+    module ServesPictures
+      SEALED = "default-src 'none'; sandbox".freeze
+      FOREVER = 1.year.to_i
+      BRIEFLY = 5.minutes.to_i
+
+      private
+
+        def deliver_picture(stamp, cache_control:, vary: nil)
+          response.headers["X-Content-Type-Options"] = "nosniff"
+          response.headers["Content-Security-Policy"] = SEALED
+          response.headers["Cache-Control"] = cache_control
+          response.headers["Vary"] = vary if vary
+          response.headers["ETag"] = %("#{stamp}")
+
+          return head :not_modified if request.headers["If-None-Match"].to_s.include?(stamp)
+
+          content_type, bytes = yield
+
+          return head :not_found if bytes.nil?
+
+          send_data bytes, type: content_type, disposition: "inline"
+        end
+    end
+  end
+end

data/app/controllers/concerns/masks/server/token_presented.rb

@@ -0,0 +1,47 @@
+module Masks
+  module Server
+    module TokenPresented
+      extend ActiveSupport::Concern
+
+      include ClientAuthentication
+
+      included do
+        skip_forgery_protection
+
+        rescue_from Policy::Denied, with: :client_denied
+      end
+
+      private
+
+        def refuse!(description)
+          raise Policy::Denied.new("invalid_request", description, status: :bad_request)
+        end
+
+        def presented_token(secret = params[:token], hint = params[:token_type_hint])
+          return nil if secret.blank?
+
+          case hint
+          when "refresh_token" then RefreshToken.redeem(secret)
+          when "access_token" then access_token_from(secret)
+          else RefreshToken.redeem(secret) || access_token_from(secret)
+          end
+        end
+
+        def access_token_from(token)
+          claims = AccessToken.decode(token, issuer: issuer, verify_expiration: false, required: %w[iss jti])
+
+          AccessToken.find_by(digest: claims["jti"])
+        rescue JWT::DecodeError
+          nil
+        end
+
+        def authenticate_client!
+          authenticated_client
+        end
+
+        def client_denied(denial)
+          render json: denial.to_h, status: denial.status
+        end
+    end
+  end
+end

data/app/controllers/masks/server/account_controller.rb

@@ -0,0 +1,73 @@
+module Masks
+  module Server
+    class AccountController < ApplicationController
+      RECENT = 20
+
+      def index
+        @actor = current_actor
+
+        return redirect_to login_path if @actor.nil?
+
+        @apps = Apps.held_by(@actor)
+        @launchable = Apps.launchable(@actor)
+        @invitations = @actor.memberships.outstanding.joins(:organization).merge(Organization.active)
+                             .includes(:organization, :invited_by).order("organizations.name").to_a
+        @memberships = @actor.memberships.live.to_a
+        ActiveRecord::Associations::Preloader.new(records: @memberships.map(&:organization), associations: { memberships: [ :actor, :invited_by ] }).call
+        @connections = Connection.live.where(actor: @actor).includes(:provider, live_delegations: :client).order(:created_at)
+        @linkable = Linking.offered(@actor)
+        @code_factors = CodeFactors::FACTORS.select do |factor|
+          CodeFactors.held?(@actor, factor) || CodeFactors.offered?(@actor, factor)
+        end
+        @passkeys = Passkey.where(actor: @actor).includes(:authenticator).newest_first
+        @devices = @actor.devices.newest_first
+        @trusted = DeviceFactor.live.where(actor: @actor).pluck(:device_id).to_set
+        @live = Session.live.where(device_id: @devices.map(&:id)).pluck(:device_id).to_set
+        @approver = DeviceFactor.satisfied?(device: current_device, actor: @actor)
+        @approving = @approver && SignInApproval.waiting.find_by(id: session[SignInApprovalsController::HELD], actor_id: @actor.id)
+        @events = Event.where(actor: @actor).newest_first.includes(:device).limit(RECENT)
+        @fresh = current_session.fresh?
+        @authenticator = AuthenticatorApp.offered?(@actor)
+        @authenticator_secret = AuthenticatorApp.setup_secret(session, @actor) if @authenticator && @fresh && !@actor.otp?
+        @backup_codes = flash[:backup_codes]
+        @pending_addresses = Addresses.pending(session, @actor)
+        @directed = @actor.directed?
+        @refusal = refusal(@actor)
+      end
+
+      def destroy
+        actor = current_actor
+
+        return redirect_to login_path if actor.nil?
+
+        refused = refusal(actor)
+        return refuse(t("account_deletion.#{refused}")) if refused
+
+        return unless reauthenticated!("delete", t("account_deletion.again"))
+
+        return refuse(t("account_deletion.mismatch")) unless params[:confirm].to_s.strip.casecmp?(actor.identifier.to_s)
+
+        held = { uuid: actor.uuid, identifier: actor.identifier, reason: "account" }
+
+        sign_out
+        actor.destroy!
+
+        Event.record!(Event::ACTOR_DELETED, by: nil, **held)
+
+        redirect_to login_path, notice: t("account_deletion.deleted")
+      end
+
+      private
+
+        def refusal(actor)
+          return :manager if actor.last_manager?
+
+          :provisioned if actor.directed?
+        end
+
+        def refuse(message)
+          redirect_to root_path(anchor: "delete"), alert: message
+        end
+    end
+  end
+end

data/app/controllers/masks/server/account_exports_controller.rb

@@ -0,0 +1,25 @@
+module Masks
+  module Server
+    class AccountExportsController < ApplicationController
+      rate_limit to: 5, within: 1.hour, only: :create,
+                 by: -> { [ current_tenant.id, current_actor&.id || request.remote_ip ].join(":") },
+                 with: -> { redirect_to root_path(anchor: "export"), alert: t("account_export.throttled") }
+
+      def create
+        actor = current_actor
+
+        return redirect_to login_path if actor.nil?
+
+        return unless reauthenticated!("export", t("account_export.again"))
+
+        export = AccountExport.new(actor)
+        body = export.to_json
+
+        Event.record!(Event::ACCOUNT_EXPORTED, actor: actor)
+
+        response.headers["Cache-Control"] = "no-store"
+        send_data body, filename: export.filename, type: "application/json", disposition: "attachment"
+      end
+    end
+  end
+end