masks-server 0.7.0

data/app/graphql/masks/server/manage/mutations/update_sign_in_policy.rb

@@ -0,0 +1,28 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class UpdateSignInPolicy < SignInPolicyMutation
+          requires :security
+
+          argument :key, ID
+
+          def resolve(key:, **attributes)
+            policy = sign_in_policy!(key)
+
+            refuse!("#{policy.name} is archived; restore it first") if policy.archived?
+
+            apply(policy, **attributes)
+
+            changed = policy.changed
+
+            save!(policy)
+            audit!(Masks::Server::Event::SIGN_IN_POLICY_UPDATED, policy: policy.key, name: policy.name, changed: changed)
+
+            { sign_in_policy: policy }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/update_tenant.rb

@@ -0,0 +1,122 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class UpdateTenant < BaseMutation
+          requires :owner
+
+          argument :name, String, required: false
+          argument :dynamic_client_scopes, [ String ], required: false
+          argument :dynamic_registration, String, required: false
+          argument :named_by, String, required: false
+          argument :browsers_only, Boolean, required: false
+          argument :blocked_agents, String, required: false
+          argument :sign_in_policy, ID, required: false
+          argument :suspend_after, Integer, required: false
+          argument :delete_after, Integer, required: false
+          argument :risky_networks, String, required: false,
+                                            description: "Address ranges, one per line in CIDR form, that add to a sign-in's risk score."
+          argument :event_retention_days, Integer, required: false,
+                                                   description: "Days to keep events, from 30 to 2555. Zero keeps the default of 180."
+
+          argument :ldap_enabled, Boolean, required: false,
+                                         description: "Whether the LDAP directory answers for this tenant."
+          argument :ldap_password_only, Boolean, required: false,
+                                                 description: "Lets a password alone bind to LDAP for accounts that would otherwise need a second factor."
+
+          argument :accent_color, String, required: false,
+                   description: "A color such as #3355aa for buttons and headings on sign-in and account pages. Empty goes back to masks' own."
+
+          argument :key_rotation_days, Integer, required: false,
+                   description: "Days between scheduled signing key rotations, from 7 to 365. Zero leaves rotation to a manager."
+
+          field :tenant, Types::TenantType, null: false
+
+          def resolve(name: nil, dynamic_client_scopes: nil, dynamic_registration: nil,
+                      named_by: nil, browsers_only: nil, blocked_agents: nil, sign_in_policy: nil,
+                      suspend_after: nil, delete_after: nil, event_retention_days: nil, risky_networks: nil,
+                      accent_color: nil, key_rotation_days: nil, ldap_enabled: nil, ldap_password_only: nil)
+            tenant = Current.tenant
+
+            tenant.name = name unless name.nil?
+            tenant.accent_color = accent_color unless accent_color.nil?
+            tenant.key_rotation_days = key_rotation_days.zero? ? nil : key_rotation_days unless key_rotation_days.nil?
+            tenant.ldap_enabled = ldap_enabled unless ldap_enabled.nil?
+            tenant.ldap_password_only = ldap_password_only unless ldap_password_only.nil?
+
+            unless named_by.nil?
+              refuse!("MASKS_NAMED_BY pins what names an account here") if tenant.names_pinned?
+
+              refuse!("an account is named by a nickname, an email or either") unless
+                Masks::Server::Tenant::NAMES.include?(named_by)
+
+              tenant.named_by = named_by
+            end
+
+            unless dynamic_registration.nil?
+              if tenant.registration_pinned?
+                refuse!("MASKS_DYNAMIC_REGISTRATION pins dynamic registration here")
+              end
+
+              unless Masks::Server::Tenant::REGISTRATIONS.include?(dynamic_registration)
+                refuse!("dynamic registration is off, anything or bounded")
+              end
+
+              tenant.dynamic_registration = dynamic_registration
+            end
+
+            unless dynamic_client_scopes.nil?
+              reserved = Scopes.reserved(dynamic_client_scopes)
+
+              if reserved.any?
+                refuse!("#{Scopes.join(reserved)} may not be offered to dynamic registration")
+              end
+
+              tenant.dynamic_client_scopes = Scopes.join(dynamic_client_scopes).presence
+            end
+
+            unless browsers_only.nil?
+              refuse!("MASKS_BROWSERS_ONLY pins who may sign in here") if tenant.browsers_pinned?
+
+              tenant.browsers_only = browsers_only
+            end
+
+            unless blocked_agents.nil?
+              refuse!("MASKS_BLOCKED_AGENTS pins the agents refused here") if tenant.agents_pinned?
+
+              tenant.blocked_agents = blocked_agents.presence
+            end
+
+            unless sign_in_policy.nil?
+              tenant.sign_in_policy = sign_in_policy.empty? ? nil : sign_in_policy!(sign_in_policy)
+
+              refuse!("#{tenant.sign_in_policy.name} is archived") if tenant.sign_in_policy&.archived?
+
+              if tenant.sign_in_policy && !tenant.sign_in_policy.local?
+                refuse!("#{tenant.sign_in_policy.name} offers no password or passkey, so it cannot be the default managers sign in with")
+              end
+            end
+
+            tenant.suspend_after = suspend_after.nonzero? unless suspend_after.nil?
+            tenant.delete_after = delete_after.nonzero? unless delete_after.nil?
+            tenant.event_retention_days = event_retention_days.nonzero? unless event_retention_days.nil?
+
+            unless risky_networks.nil?
+              listed = risky_networks.split(/[\s,]+/).compact_blank
+              unreadable = listed.size - Masks::Server::Risk.networks(listed.join(" ")).size
+              refuse!("#{unreadable} of those address ranges could not be read") if unreadable.positive?
+
+              tenant.risky_networks = listed.join("\n").presence
+            end
+
+            save!(tenant)
+
+            audit!(Masks::Server::Event::TENANT_UPDATED, name: tenant.name)
+
+            { tenant: tenant }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/upload_avatar.rb

@@ -0,0 +1,27 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class UploadAvatar < BaseMutation
+          requires :support
+
+          argument :uuid, ID
+          argument :photo, Types::UploadType
+
+          field :actor, Types::ActorType, null: false
+
+          def resolve(uuid:, photo:)
+            actor = actor!(uuid)
+
+            Avatar.store!(actor: actor, upload: photo)
+            audit!(Masks::Server::Event::AVATAR_UPLOADED, actor: actor)
+
+            { actor: actor }
+          rescue Pictures::Unreadable => e
+            refuse!(e.message)
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/upload_tenant_logo.rb

@@ -0,0 +1,23 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class UploadTenantLogo < BaseMutation
+          requires :owner
+
+          argument :logo, Types::UploadType
+
+          field :tenant, Types::TenantType, null: false
+
+          def resolve(logo:)
+            Masks::Server::TenantLogo.store!(Current.tenant, logo)
+
+            { tenant: Current.tenant }
+          rescue Pictures::Unreadable => e
+            refuse!(e.message)
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/verify_email.rb

@@ -0,0 +1,26 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class VerifyEmail < BaseMutation
+          requires :support
+
+          argument :uuid, ID
+
+          field :actor, Types::ActorType, null: false
+          field :delivered, Boolean, null: false
+          field :url, String
+
+          def resolve(uuid:)
+            actor = actor!(uuid)
+
+            refuse!("#{actor.identifier} has no email address") if actor.email.blank?
+            refuse!("#{actor.email} is already confirmed") if actor.email_verified_at.present?
+
+            Verifications.open(actor: actor, journey: Masks::Server::Journey.manage(viewer)).merge(actor: actor)
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/sources/membership_counts.rb

@@ -0,0 +1,29 @@
+module Masks
+  module Server
+    module Manage
+      module Sources
+        class MembershipCounts < GraphQL::Dataloader::Source
+          def initialize(kind)
+            @kind = kind
+          end
+
+          def fetch(ids)
+            counted = relation.where(organization_id: ids).group(:organization_id).count
+
+            ids.map { |id| counted.fetch(id, 0) }
+          end
+
+          private
+
+            def relation
+              case @kind
+              when :members then Masks::Server::Membership.accepted
+              when :owners then Masks::Server::Membership.accepted.where(role: Masks::Server::Organization::OWNER)
+              when :pending then Masks::Server::Membership.outstanding
+              end
+            end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/activity_day_type.rb

@@ -0,0 +1,12 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class ActivityDayType < BaseObject
+          field :date, GraphQL::Types::ISO8601Date, null: false
+          field :sign_ins, Integer, null: false
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/actor_type.rb

@@ -0,0 +1,151 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class ActorType < BaseObject
+          field :uuid, ID, null: false
+          field :identifier, String, null: false
+          field :nickname, String
+          field :email, String
+          field :email_verified, Boolean, null: false
+          field :phone, String
+          field :phone_verified, Boolean, null: false
+          field :signed_up_at, GraphQL::Types::ISO8601DateTime
+          field :pending_approval, Boolean, null: false
+          field :recovery_requested_at, GraphQL::Types::ISO8601DateTime,
+                description: "When this actor, past their first factor, asked a manager to reset their second factors."
+          field :suspended_at, GraphQL::Types::ISO8601DateTime
+          field :external_id, String, description: "The id a tenant-wide directory knows this actor by. " \
+                                                   "An organization's directory keeps its own on the membership."
+          field :activated, Boolean, null: false
+          field :invited_at, GraphQL::Types::ISO8601DateTime
+          field :scopes, [ String ], null: false
+          field :otp_enabled, Boolean, null: false
+          field :email_codes_enabled, Boolean, null: false
+          field :text_codes_enabled, Boolean, null: false
+          field :backup_codes_remaining, Integer, null: false
+          field :passkeys, [ PasskeyType ], null: false
+          field :sessions, [ "Masks::Server::Manage::Types::SessionType" ], null: false
+          field :devices, [ "Masks::Server::Manage::Types::DeviceType" ], null: false
+          field :connections, [ "Masks::Server::Manage::Types::ConnectionType" ], null: false
+          field :consents, [ "Masks::Server::Manage::Types::ConsentType" ], null: false
+          field :tokens, [ "Masks::Server::Manage::Types::TokenType" ], null: false
+          field :memberships, [ "Masks::Server::Manage::Types::MembershipType" ], null: false
+          field :groups, [ "Masks::Server::Manage::Types::GroupType" ], null: false
+          field :group_labels, [ String ], null: false,
+                description: "What the groups claim carries: each group's key, and each organization role as key:role."
+
+          field :events, [ "Masks::Server::Manage::Types::EventType" ], null: false do
+            argument :limit, Integer, required: false
+          end
+          field :backup_codes_generated_at, GraphQL::Types::ISO8601DateTime
+          field :last_login_at, GraphQL::Types::ISO8601DateTime
+          field :last_active_at, GraphQL::Types::ISO8601DateTime
+          field :idle_warned_at, GraphQL::Types::ISO8601DateTime
+          field :created_at, GraphQL::Types::ISO8601DateTime, null: false
+          field :updated_at, GraphQL::Types::ISO8601DateTime, null: false
+
+          field :avatars, AvatarsType, null: false
+          field :photo_uploaded, Boolean, null: false
+
+          field :name, String
+          field :given_name, String
+          field :family_name, String
+          field :middle_name, String
+          field :profile_url, String
+          field :picture_url, String
+          field :website_url, String
+          field :gender, String
+          field :birthdate, String
+          field :zoneinfo, String
+          field :locale, String
+
+          def email_verified
+            object.email_verified_at.present?
+          end
+
+          def phone_verified
+            object.phone_verified_at.present?
+          end
+
+          def pending_approval
+            object.pending_approval_at.present?
+          end
+
+          def activated
+            object.activated?
+          end
+
+          def invited_at
+            return nil if object.activated?
+
+            Invitation.where(actor_id: object.id).live.maximum(:created_at)
+          end
+
+          def scopes
+            object.scope_list
+          end
+
+          def otp_enabled
+            object.otp?
+          end
+
+          def email_codes_enabled
+            object.email_factor?
+          end
+
+          def text_codes_enabled
+            object.phone_factor?
+          end
+
+          def avatars
+            Masks::Server::Avatars.urls(object, subject: object.uuid)
+          end
+
+          def photo_uploaded
+            Masks::Server::Avatars.photo(object).present?
+          end
+
+          def passkeys
+            Masks::Server::Passkey.where(actor_id: object.id).includes(:authenticator).newest_first
+          end
+
+          def sessions
+            Masks::Server::Session.live.where(actor_id: object.id).order(created_at: :desc)
+          end
+
+          def devices
+            Masks::Server::Device.for_actor(object).newest_first
+          end
+
+          def connections
+            Masks::Server::Connection.live.where(actor_id: object.id).includes(:provider).order(created_at: :desc)
+          end
+
+          def consents
+            Masks::Server::Consent.live.where(actor_id: object.id).includes(:client).order(updated_at: :desc)
+          end
+
+          def memberships
+            object.memberships.includes(:organization).joins(:organization).order("organizations.name")
+          end
+
+          def tokens
+            Masks::Server::Token.where(kind: TokenType::GRANTS, actor_id: object.id)
+                   .live
+                   .includes(:client, :device)
+                   .order(created_at: :desc)
+          end
+
+          def events(limit: nil)
+            Masks::Server::Event
+              .where(actor_id: object.id)
+              .newest_first
+              .includes(:by, :client, :device)
+              .limit(Masks::Server::Event.bounded(limit))
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/app_preset_type.rb

@@ -0,0 +1,18 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class AppPresetType < BaseObject
+          description "A self-hosted app masks knows how to register."
+
+          field :key, ID, null: false
+          field :name, String, null: false
+          field :asks, GraphQL::Types::JSON, null: false,
+                description: "Values the app's redirect URIs need beyond its address, with their usual defaults."
+          field :scopes, [ String ], null: false
+          field :guide, String
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/app_setting_type.rb

@@ -0,0 +1,14 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class AppSettingType < BaseObject
+          description "One value to enter in the app, under the label the app uses for it."
+
+          field :label, String, null: false
+          field :value, String, null: false
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/avatars_type.rb

@@ -0,0 +1,13 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class AvatarsType < BaseObject
+          field :photo, String
+          field :identicon, String, null: false
+          field :initials, String, null: false
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/base_object.rb

@@ -0,0 +1,10 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class BaseObject < GraphQL::Schema::Object
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/client_type.rb

@@ -0,0 +1,121 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class ClientType < BaseObject
+          field :client_id, ID, null: false
+          field :name, String, null: false
+          field :redirect_uris, [ String ], null: false
+          field :post_logout_redirect_uris, [ String ], null: false
+          field :grant_types, [ String ], null: false
+          field :response_types, [ String ], null: false
+          field :resources, [ String ], null: false
+          field :required_scopes, [ String ], null: false
+          field :allowed_scopes, [ String ], null: false
+          field :access_token_lifetime, Integer,
+                description: "Seconds an access token lasts. Null is an hour."
+          field :refresh_token_lifetime, Integer,
+                description: "Seconds a refresh token lasts unused. Each refresh starts it over. Null is 30 days."
+          field :allowed_groups, [ String ], null: false,
+                description: "Group keys, or organization roles as key:role, whose people may sign in. Empty lets everyone in."
+          field :namespaces, [ "Masks::Server::Manage::Types::NamespaceType" ], null: false
+          field :token_endpoint_auth_method, String, null: false
+          field :subject_type, String, null: false
+          field :dpop_bound_access_tokens, Boolean, null: false
+          field :sector_identifier_uri, String
+          field :application_type, String, null: false
+          field :client_uri, String
+          field :logo_uri, String
+          field :tos_uri, String
+          field :policy_uri, String
+          field :logo_url, String do
+            argument :size, Integer, required: false
+          end
+          field :backchannel_logout_uri, String
+          field :backchannel_logout_session_required, Boolean, null: false
+          field :require_pushed_authorization_requests, Boolean, null: false
+          field :jwks, GraphQL::Types::JSON
+          field :jwks_uri, String
+          field :consent_lifetime, Integer,
+                description: "Seconds a person's consent lasts before they are asked again. Null lasts until revoked."
+          field :authorization_details_types, [ String ], null: false,
+                description: "The types of authorization detail this client may ask for."
+          field :authorization_details_schemas, GraphQL::Types::JSON, null: false,
+                description: "The types of authorization detail this client accepts as a resource, with the label and schema of each."
+          field :protocol, String, null: false
+          field :saml_entity_id, String
+          field :saml_certificate, String
+          field :saml_name_id_format, String
+          field :saml_requests_signed, Boolean, null: false
+          field :saml_idp_initiated, Boolean, null: false
+          field :saml_attributes, GraphQL::Types::JSON, null: false
+          field :saml_slo_url, String,
+                description: "Where masks posts a signed LogoutRequest when a person who signed in to this SAML application signs out, and its LogoutResponse when the application asks."
+          field :require_signed_request_object, Boolean, null: false
+          field :consent_required, Boolean, null: false
+          field :sign_in_policy, SignInPolicyType
+          field :dynamic, Boolean, null: false
+          field :approved_at, GraphQL::Types::ISO8601DateTime
+          field :approved_by, ActorType
+          field :archived_at, GraphQL::Types::ISO8601DateTime
+          field :secret_expires_at, GraphQL::Types::ISO8601DateTime
+          field :created_at, GraphQL::Types::ISO8601DateTime, null: false
+
+          field :delegations, [ "Masks::Server::Manage::Types::DelegationType" ], null: false
+
+          field :consents, [ "Masks::Server::Manage::Types::ConsentType" ], null: false do
+            argument :limit, Integer, required: false
+          end
+
+          field :tokens, [ "Masks::Server::Manage::Types::TokenType" ], null: false do
+            argument :limit, Integer, required: false
+          end
+
+          field :events, [ "Masks::Server::Manage::Types::EventType" ], null: false do
+            argument :limit, Integer, required: false
+          end
+
+          def tokens(limit: nil)
+            Masks::Server::Token.where(kind: TokenType::GRANTS, client_id: object.id)
+                   .live
+                   .includes(:actor, :device)
+                   .order(created_at: :desc)
+                   .limit(limit || QueryType::LIMIT)
+          end
+
+          def delegations
+            Masks::Server::Delegation.live.where(client_id: object.id).includes(:actor, connection: :provider).order(created_at: :desc)
+          end
+
+          def consents(limit: nil)
+            Masks::Server::Consent.live
+                     .where(client_id: object.id)
+                     .includes(:actor)
+                     .order(updated_at: :desc)
+                     .limit(limit || QueryType::LIMIT)
+          end
+
+          def events(limit: nil)
+            Masks::Server::Event
+              .where(client_id: object.id)
+              .newest_first
+              .includes(:actor, :by, :device)
+              .limit(Masks::Server::Event.bounded(limit))
+          end
+
+          def logo_url(size: nil)
+            object.logo_url(context[:actor], size: size)
+          end
+
+          def required_scopes
+            Scopes.list(object.required_scopes)
+          end
+
+          def allowed_scopes
+            Scopes.list(object.allowed_scopes)
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/connection_type.rb

@@ -0,0 +1,37 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class ConnectionType < BaseObject
+          field :id, ID, null: false
+          field :provider, ProviderType, null: false
+          field :actor, ActorType, null: false
+          field :subject, String, null: false
+          field :label, String
+          field :email, String
+          field :email_verified, Boolean, null: false
+          field :connected_at, GraphQL::Types::ISO8601DateTime
+          field :signed_in_at, GraphQL::Types::ISO8601DateTime
+          field :revoked_at, GraphQL::Types::ISO8601DateTime
+          field :revoked_reason, String
+          field :created_at, GraphQL::Types::ISO8601DateTime, null: false
+          field :delegable, Boolean, null: false
+          field :tokens_refreshed_at, GraphQL::Types::ISO8601DateTime
+          field :delegations, [ "Masks::Server::Manage::Types::DelegationType" ], null: false
+
+          def id
+            object.uuid
+          end
+
+          def delegable
+            object.delegable?
+          end
+
+          def delegations
+            object.delegations.live.includes(:client).order(created_at: :desc)
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/consent_type.rb

@@ -0,0 +1,30 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class ConsentType < BaseObject
+          field :id, ID, null: false
+          field :actor, ActorType, null: false
+          field :client, ClientType, null: false
+          field :scopes, [ String ], null: false
+          field :audience, [ String ], null: false
+          field :authorization_details, GraphQL::Types::JSON, null: false,
+                description: "The authorization details the person allowed this client to ask for again without asking them, each with the time it expires."
+          field :expires_at, GraphQL::Types::ISO8601DateTime,
+                description: "When this consent ends and the person is asked again. Null lasts until revoked."
+          field :revoked_at, GraphQL::Types::ISO8601DateTime
+          field :created_at, GraphQL::Types::ISO8601DateTime, null: false
+          field :updated_at, GraphQL::Types::ISO8601DateTime, null: false
+
+          def scopes
+            Scopes.list(object.scopes)
+          end
+
+          def audience
+            Array(object.audience)
+          end
+        end
+      end
+    end
+  end
+end