masks-server 0.7.0

data/app/graphql/masks/server/manage/mutations/export_events.rb

@@ -0,0 +1,41 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class ExportEvents < BaseMutation
+          requires :read
+
+          description "Prepares a download of every event in a range as newline-delimited JSON, one event per line " \
+                      "in the shape event streams send. The link works for ten minutes, in a browser signed in as the " \
+                      "manager who asked for it."
+
+          argument :from, GraphQL::Types::ISO8601DateTime
+          argument :to, GraphQL::Types::ISO8601DateTime
+          argument :action, String, required: false
+          argument :organization, ID, required: false
+          argument :actor, ID, required: false
+
+          field :url, String, null: false
+          field :count, Integer, null: false
+          field :expires_at, GraphQL::Types::ISO8601DateTime, null: false
+
+          def resolve(from:, to:, **filters)
+            export = Masks::Server::EventExport.new(from: from, to: to, by: viewer.uuid, filters: filters).validate!
+            count = export.scope.count
+
+            audit!(Masks::Server::Event::EVENTS_EXPORTED, from: from.iso8601, to: to.iso8601, count: count,
+                                                         **export.filters.transform_keys(&:to_sym).except(:organization))
+
+            {
+              url: "#{Current.origin}/manage/exports/#{ERB::Util.url_encode(export.secret(Current.tenant))}",
+              count: count,
+              expires_at: Masks::Server::EventExport::LIFETIME.from_now
+            }
+          rescue Masks::Server::EventExport::Refused => e
+            refuse!(e.message)
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/generate_backup_codes.rb

@@ -0,0 +1,31 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class GenerateBackupCodes < BaseMutation
+          requires :support
+
+          argument :uuid, ID
+
+          field :actor, Types::ActorType, null: false
+          field :codes, [ String ], null: false
+
+          def resolve(uuid:)
+            actor = actor!(uuid)
+            needs!(:security, "generating someone's backup codes")
+
+            unless actor.second_factor?
+              refuse!("a backup code is a way past a second factor, and this actor has none")
+            end
+
+            codes = actor.generate_backup_codes!
+
+            audit!(Masks::Server::Event::BACKUP_CODES_GENERATED, actor: actor, count: codes.length)
+
+            { codes: codes, actor: actor }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/invite_actors.rb

@@ -0,0 +1,46 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class InviteActors < BaseMutation
+          requires :support
+
+          LIMIT = 200
+
+          argument :emails, [ String ], description: "Up to #{LIMIT} addresses. Blank lines and repeats are skipped."
+          argument :groups, [ String ], required: false, description: "Keys of groups to put everyone invited in."
+
+          field :outcomes, [ Types::InvitationOutcomeType ], null: false
+
+          def resolve(emails:, groups: [])
+            wanted = emails.filter_map { |email| Actor.normalize_value_for(:email, email) }.uniq
+            refuse!("invite at most #{LIMIT} addresses at once") if wanted.size > LIMIT
+
+            joining = groups.map { |key| group!(key) }
+            needs!(:security, "putting people in groups") if joining.any?
+
+            { outcomes: wanted.map { |email| invite(email, joining) } }
+          end
+
+          private
+
+            def invite(email, joining)
+              actor = Actor.new(email: email, scopes: Scopes.join(Scopes::STANDARD))
+
+              unless actor.save
+                return outcome(email, actor.errors.of_kind?(:email, :taken) ? "exists" : "invalid")
+              end
+
+              joining.each { |group| group.add!(actor, by: viewer) }
+
+              outcome(email, "invited", actor: actor, **invited!(actor))
+            end
+
+            def outcome(email, kind, actor: nil, delivered: false, url: nil)
+              { email: email, outcome: kind, actor: actor, delivered: delivered, url: url }
+            end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/issue_ldap_credential.rb

@@ -0,0 +1,28 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class IssueLdapCredential < BaseMutation
+          requires :owner
+
+          description "Issues a bind DN and secret an app uses to search this tenant's LDAP directory. The secret is returned once."
+
+          argument :label, String, description: "Lowercase letters, digits, dots, dashes, and underscores. It becomes the cn of the bind DN."
+
+          field :ldap_credential, Types::LdapCredentialType, null: false
+          field :secret, String, null: false
+
+          def resolve(label:)
+            credential = Masks::Server::LdapCredential.issue!(label: label, by: viewer)
+
+            audit!(Masks::Server::Event::LDAP_CREDENTIAL_ISSUED, label: credential.label)
+
+            { ldap_credential: credential, secret: credential.secret }
+          rescue Masks::Server::LdapCredential::Refused => e
+            refuse!(e.message)
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/issue_provisioning_token.rb

@@ -0,0 +1,33 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class IssueProvisioningToken < BaseMutation
+          requires :security
+
+          argument :label, String
+          argument :expires_in, Integer, required: false
+          argument :organization, ID, required: false,
+                                      description: "An organization's key. The token then sees and adds only that organization's members. " \
+                                                   "Only an owner can issue a token without one."
+
+          field :provisioning_token, Types::ProvisioningTokenType, null: false
+          field :secret, String, null: false
+
+          def resolve(label:, expires_in: nil, organization: nil)
+            refuse!("a provisioning token lives for a positive number of seconds") if expires_in && !expires_in.positive?
+
+            held = organization && (Masks::Server::Organization.active.find_by(key: organization) || refuse!("no organization keyed #{organization}"))
+            refuse!("only an owner can issue a token for every account; name an organization") if held.nil? && !owner?
+            token = Masks::Server::ProvisioningToken.issue!(label: label, by: viewer, expires_in: expires_in, organization: held)
+
+            audit!(Masks::Server::Event::PROVISIONING_TOKEN_ISSUED, label: token.label, expires_at: token.expires_at.iso8601,
+                                                                    organization: held&.key)
+
+            { provisioning_token: token, secret: token.secret }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/organization_mutation.rb

@@ -0,0 +1,26 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class OrganizationMutation < BaseMutation
+          private
+
+            def organization!(key)
+              Masks::Server::Organization.find_by(key: key) || refuse!("no organization keyed #{key}")
+            end
+
+            def member!(organization, actor)
+              organization.memberships.find_by(actor: actor) ||
+                refuse!("#{actor.identifier} is not a member of #{organization.name}")
+            end
+
+            def live!(organization)
+              refuse!("#{organization.name} is archived; restore it first") if organization.archived?
+
+              organization
+            end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/read_saml_application_metadata.rb

@@ -0,0 +1,39 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class ReadSamlApplicationMetadata < BaseMutation
+          requires :security
+
+          NAMES = { "md" => SamlIdentity::METADATA_NS, "ds" => SamlIdentity::DSIG_NS }.freeze
+
+          argument :xml, String
+
+          field :entity_id, String
+          field :acs_urls, [ String ], null: false
+          field :certificate, String
+          field :name_id_format, String
+          field :requests_signed, Boolean, null: false
+          field :slo_url, String, description: "The location of its HTTP-POST SingleLogoutService."
+
+          def resolve(xml:)
+            document = SamlIdentity.parse!(xml, what: "that metadata")
+            descriptor = document.at_xpath("//md:SPSSODescriptor", NAMES) || refuse!("that is not a service provider's metadata")
+
+            {
+              entity_id: descriptor.parent["entityID"],
+              acs_urls: descriptor.xpath("md:AssertionConsumerService[@Binding='#{SamlIdentity::POST_BINDING}']", NAMES)
+                                  .sort_by { |service| service["isDefault"] == "true" ? 0 : 1 }.filter_map { |service| service["Location"] },
+              certificate: descriptor.at_xpath("md:KeyDescriptor[not(@use) or @use='signing']//ds:X509Certificate", NAMES)&.text&.gsub(/\s+/, ""),
+              name_id_format: descriptor.xpath("md:NameIDFormat", NAMES).map(&:text).map(&:strip).find { |one| SamlIdentity::NAME_ID_FORMATS.include?(one) },
+              requests_signed: descriptor["AuthnRequestsSigned"] == "true",
+              slo_url: descriptor.at_xpath("md:SingleLogoutService[@Binding='#{SamlIdentity::POST_BINDING}']", NAMES)&.[]("Location")
+            }
+          rescue SamlIdentity::Refused => e
+            refuse!(e.message)
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/read_saml_metadata.rb

@@ -0,0 +1,43 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class ReadSamlMetadata < BaseMutation
+          requires :security
+
+          argument :metadata_url, String, required: false
+          argument :metadata_xml, String, required: false
+
+          field :idp_entity_id, String, null: false
+          field :idp_sso_url, String, null: false
+          field :idp_certificates, String, null: false
+
+          def resolve(metadata_url: nil, metadata_xml: nil)
+            refuse!("pass a metadata URL or the metadata itself") if metadata_url.blank? && metadata_xml.blank?
+
+            xml = metadata_xml.presence || fetch(metadata_url)
+            parsed = Masks::Server::Federation::Saml.parse_metadata(xml)
+
+            refuse!("that metadata names no single sign-on URL for the redirect binding") if parsed[:idp_sso_url].blank?
+            refuse!("that metadata holds no signing certificate") if parsed[:idp_certificates].blank?
+
+            parsed
+          rescue Masks::Server::Provider::Untrusted, Masks::Server::Provider::Refused, Masks::Server::Provider::Unreachable => e
+            refuse!(e.message)
+          end
+
+          private
+
+            def fetch(url)
+              probe = Masks::Server::Provider.new(name: "metadata", metadata_url: url, protocol: Masks::Server::Provider::SAML)
+              probe.validate
+
+              refuse!("metadata URL #{probe.errors[:metadata_url].first}") if probe.errors[:metadata_url].any?
+
+              probe.fetch_text(url, Masks::Server::Federation::Saml::METADATA_LIMIT)
+            end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/register_provider.rb

@@ -0,0 +1,30 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class RegisterProvider < BaseMutation
+          requires :security
+
+          argument :key, ID
+
+          field :provider, Types::ProviderType, null: false
+
+          def resolve(key:)
+            provider = provider!(key)
+
+            refuse!("only an MCP server's authorization server is registered with") unless provider.mcp?
+
+            provider.register!(callback: provider.callback_url)
+
+            save!(provider)
+            audit!(Masks::Server::Event::PROVIDER_UPDATED, provider: provider.key, changed: %w[client_id registered_at])
+
+            { provider: provider }
+          rescue Masks::Server::Provider::Untrusted, Masks::Server::Provider::Refused, Masks::Server::Provider::Unreachable => e
+            refuse!(e.message)
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/release_domain.rb

@@ -0,0 +1,25 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class ReleaseDomain < DomainMutation
+          requires :security
+
+          argument :domain, String
+
+          field :domain, String, null: false
+
+          def resolve(domain:)
+            claim = claim!(domain)
+            claim.destroy!
+
+            audit!(Masks::Server::Event::DOMAIN_RELEASED, domain: claim.domain, reason: "released")
+            Current.tenant.unserve_uncovered!("released")
+
+            { domain: claim.domain }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/release_namespace.rb

@@ -0,0 +1,28 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class ReleaseNamespace < BaseMutation
+          requires :security
+
+          argument :name, String
+
+          field :released, String, null: false
+
+          def resolve(name:)
+            held = Namespace.find_by(name: name) || refuse!("no namespace by that name is claimed")
+
+            unless held.releasable?
+              refuse!("#{held.name} is in use by #{held.client.name}; archive it first")
+            end
+
+            held.release!
+            audit!(Masks::Server::Event::NAMESPACE_RELEASED, name: held.name)
+
+            { released: held.name }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/remove_avatar.rb

@@ -0,0 +1,27 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class RemoveAvatar < BaseMutation
+          requires :support
+
+          argument :uuid, ID
+
+          field :actor, Types::ActorType, null: false
+
+          def resolve(uuid:)
+            actor = actor!(uuid)
+            held = Masks::Server::Avatars.photo(actor)
+
+            refuse!("that actor has no photo") if held.nil?
+
+            held.destroy!
+            audit!(Masks::Server::Event::AVATAR_REMOVED, actor: actor)
+
+            { actor: actor.reload }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/remove_group_member.rb

@@ -0,0 +1,25 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class RemoveGroupMember < BaseMutation
+          requires :security
+
+          argument :key, String
+          argument :uuid, ID
+
+          field :group, Types::GroupType, null: false
+
+          def resolve(key:, uuid:)
+            group = group!(key)
+            actor = actor!(uuid)
+
+            group.remove!(actor, by: viewer)
+
+            { group: group }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/remove_member.rb

@@ -0,0 +1,26 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class RemoveMember < OrganizationMutation
+          requires :support
+
+          argument :organization, ID
+          argument :uuid, ID
+
+          field :organization, Types::OrganizationType, null: false
+
+          def resolve(organization:, uuid:)
+            held = organization!(organization)
+            actor = actor!(uuid)
+            Masks::Server::Members.remove!(member!(held, actor), by: viewer)
+
+            { organization: held }
+          rescue Masks::Server::Members::Refused => e
+            refuse!(e.message)
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/remove_tenant_logo.rb

@@ -0,0 +1,19 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class RemoveTenantLogo < BaseMutation
+          requires :owner
+
+          field :tenant, Types::TenantType, null: false
+
+          def resolve
+            Masks::Server::TenantLogo.forget!(Current.tenant)
+
+            { tenant: Current.tenant }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/resend_invitation.rb

@@ -0,0 +1,25 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class ResendInvitation < BaseMutation
+          requires :support
+
+          argument :uuid, ID
+
+          field :actor, Types::ActorType, null: false
+          field :delivered, Boolean, null: false
+          field :url, String
+
+          def resolve(uuid:)
+            actor = actor!(uuid)
+
+            refuse!("#{actor.identifier} has already accepted an invitation") if actor.activated?
+
+            Invitations.open(actor: actor, journey: Masks::Server::Journey.manage(viewer)).merge(actor: actor)
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/resend_organization_invitation.rb

@@ -0,0 +1,31 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class ResendOrganizationInvitation < OrganizationMutation
+          requires :support
+
+          description "Sends an organization invitation again and starts its lifetime over. " \
+                      "An invitation is sent again at most once an hour."
+
+          argument :organization, ID
+          argument :uuid, ID
+
+          field :membership, Types::MembershipType, null: false
+          field :delivered, Boolean, null: false
+          field :url, String
+
+          def resolve(organization:, uuid:)
+            held = live!(organization!(organization))
+            membership = member!(held, actor!(uuid))
+
+            Masks::Server::Members.resend!(membership, by: viewer, journey: Masks::Server::Journey.manage(viewer),
+                                                       manager: true)
+          rescue Masks::Server::Members::Refused => e
+            refuse!(e.message)
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/reset_password.rb

@@ -0,0 +1,26 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class ResetPassword < BaseMutation
+          requires :support
+
+          argument :uuid, ID
+
+          field :actor, Types::ActorType, null: false
+          field :delivered, Boolean, null: false
+          field :url, String
+
+          def resolve(uuid:)
+            actor = actor!(uuid)
+
+            refuse!("#{actor.identifier} has not accepted an invitation yet") unless actor.activated?
+            needs!(:security, "handing over a reset link masks cannot mail") unless Recoveries.mailable?(actor)
+
+            Recoveries.open(actor: actor, journey: Masks::Server::Journey.manage(viewer)).merge(actor: actor)
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/reset_second_factors.rb

@@ -0,0 +1,23 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class ResetSecondFactors < BaseMutation
+          requires :support
+
+          argument :uuid, ID
+
+          field :actor, Types::ActorType, null: false
+
+          def resolve(uuid:)
+            actor = actor!(uuid)
+
+            Masks::Server::HelpRequests.reset!(actor, by: viewer)
+
+            { actor: actor.reload }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/restore_actor.rb

@@ -0,0 +1,26 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class RestoreActor < BaseMutation
+          requires :support
+
+          argument :uuid, ID
+
+          field :actor, Types::ActorType, null: false
+
+          def resolve(uuid:)
+            actor = actor!(uuid)
+
+            refuse!("#{actor.identifier} is not suspended") unless actor.suspended?
+
+            actor.restore!
+            audit!(Masks::Server::Event::ACTOR_RESTORED, actor: actor)
+
+            { actor: actor }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/restore_client.rb

@@ -0,0 +1,45 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class RestoreClient < BaseMutation
+          requires :security
+
+          argument :client_id, ID
+
+          field :client, Types::ClientType, null: false
+
+          def resolve(client_id:)
+            client = client!(client_id)
+
+            refuse!("#{client.name} is not archived") if client.archived_at.nil?
+
+            taken = client.resources.filter_map { |resource| holder(resource, client) }.uniq
+
+            if taken.any?
+              refuse!(
+                "#{taken.map(&:name).join(', ')} answers for #{client.resources.join(', ')} now; " \
+                "archive it first"
+              )
+            end
+
+            client.archived_at = nil
+            save!(client)
+
+            audit!(Masks::Server::Event::CLIENT_RESTORED, client: client, name: client.name)
+
+            { client: client }
+          end
+
+          private
+
+            def holder(resource, client)
+              held = Masks::Server::Client.approved_for(resource)
+
+              held if held && held.id != client.id
+            end
+        end
+      end
+    end
+  end
+end