masks-server 0.7.0

data/app/graphql/masks/server/manage/types/tally_type.rb

@@ -0,0 +1,14 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class TallyType < BaseObject
+          field :actors, Integer, null: false
+          field :clients, Integer, null: false
+          field :devices, Integer, null: false
+          field :organizations, Integer, null: false, description: "Organizations that are not archived."
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/tenant_type.rb

@@ -0,0 +1,64 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class TenantType < BaseObject
+          field :uuid, ID, null: false
+          field :subdomain, String, null: false
+          field :custom_host, String, description: "The host sign-in is also served from, within a proven domain."
+          field :origins, [ String ], null: false, description: "Every origin this tenant answers on, each its own issuer."
+
+          def origins
+            [ object.templated_origin, object.custom_origin ].compact
+          end
+          field :name, String, null: false
+          field :named_by, String, null: false
+          field :browsers_only, Boolean, null: false
+          field :blocked_agents, String
+          field :mails, Boolean, null: false
+          field :accent_color, String
+          field :key_rotation_days, Integer, description: "Days between scheduled signing key rotations, or null when a manager rotates by hand."
+          field :logo_url, String, description: "The tenant's logo, 128 pixels square, or null for its initial."
+          field :texts, Boolean, null: false
+          field :sign_in_policy, SignInPolicyType
+          field :dynamic_registration, String, null: false
+          field :dynamic_client_scopes, [ String ]
+          field :suspend_after, Integer
+          field :delete_after, Integer
+          field :risky_networks, String, description: "Address ranges that add to a sign-in's risk score, one per line."
+          field :event_retention_days, Integer, null: false, description: "Days events are kept before they are deleted."
+
+          def event_retention_days
+            object.event_retention.in_days.round
+          end
+          field :ldap_enabled, Boolean, null: false, description: "Whether the LDAP directory answers for this tenant.", method: :ldap?
+          field :ldap_password_only, Boolean, null: false,
+                                     description: "Whether a password alone binds to LDAP for an account that would otherwise need a second factor.",
+                                     method: :ldap_password_only?
+          field :created_at, GraphQL::Types::ISO8601DateTime, null: false
+          field :signing_keys, [ SigningKeyType ], null: false
+
+          def logo_url
+            object.logo_url(size: 128)
+          end
+
+          def mails
+            object.mails?
+          end
+
+          def texts
+            object.texts?
+          end
+
+          def dynamic_client_scopes
+            object.dynamic_client_scopes.presence && Scopes.list(object.dynamic_client_scopes)
+          end
+
+          def signing_keys
+            object.signing_keys.published
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/token_type.rb

@@ -0,0 +1,42 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class TokenType < BaseObject
+          GRANTS = %w[access refresh code].freeze
+
+          field :id, ID, null: false
+          field :kind, String, null: false
+          field :actor, ActorType
+          field :client, ClientType
+          field :device, "Masks::Server::Manage::Types::DeviceType"
+          field :session, "Masks::Server::Manage::Types::SessionType"
+          field :scopes, [ String ], null: false
+          field :audience, [ String ], null: false
+          field :live, Boolean, null: false
+          field :parent_id, ID
+          field :authenticated_at, GraphQL::Types::ISO8601DateTime
+          field :expires_at, GraphQL::Types::ISO8601DateTime, null: false
+          field :consumed_at, GraphQL::Types::ISO8601DateTime
+          field :created_at, GraphQL::Types::ISO8601DateTime, null: false
+
+          def kind
+            object.kind
+          end
+
+          def scopes
+            object.scope_list
+          end
+
+          def audience
+            Array(object.audience)
+          end
+
+          def live
+            object.live?
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/types/upload_type.rb

@@ -0,0 +1,21 @@
+module Masks
+  module Server
+    module Manage
+      module Types
+        class UploadType < GraphQL::Schema::Scalar
+          graphql_name "Upload"
+
+          def self.coerce_input(value, _context)
+            return value if value.respond_to?(:read)
+
+            raise GraphQL::CoercionError, "that argument has to be an uploaded file"
+          end
+
+          def self.coerce_result(_value, _context)
+            raise GraphQL::CoercionError, "an upload is never handed back"
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage_schema.rb

@@ -0,0 +1,23 @@
+module Masks
+  module Server
+    class ManageSchema < GraphQL::Schema
+      query Manage::Types::QueryType
+      mutation Manage::Types::MutationType
+
+      use GraphQL::Dataloader
+
+      max_depth 12
+      max_complexity 300
+      max_query_string_tokens 5000
+      validate_max_errors 100
+
+      def self.unauthorized_object(error)
+        raise GraphQL::ExecutionError, "#{error.type.graphql_name} is not accessible"
+      end
+
+      def self.type_error(error, context)
+        raise GraphQL::ExecutionError, error.message
+      end
+    end
+  end
+end

data/app/helpers/masks/server/account_helper.rb

@@ -0,0 +1,59 @@
+module Masks
+  module Server
+    module AccountHelper
+      ICONS = {
+        email: '<path d="M3 6.5h14v11H3z"/><path d="m3.5 7 6.5 5 6.5-5"/>',
+        password: '<circle cx="8" cy="8" r="3.5"/><path d="m10.5 10.5 6 6M14 14l1.5-1.5M16 16l1-1"/>',
+        passkey: '<path d="M10 3.5c-3 0-5.5 2.4-5.5 5.4 0 1.2.3 2.1.8 3"/><path d="M10 6.5c-1.4 0-2.5 1.1-2.5 2.4 0 2.6.4 4.4 1 6.1"/><path d="M10 9c0 3 .4 5.2 1 7"/><path d="M15.2 5.5c.8 1 1.3 2.2 1.3 3.4 0 2.6-.3 4.6-.9 6.4"/><path d="M12.5 8.9c0 2.6-.2 4.5-.7 6.1"/>',
+        device: '<rect x="6" y="2.5" width="8" height="15" rx="2"/><path d="M9 15h2"/>',
+        apps: '<rect x="3" y="3" width="6" height="6" rx="1.5"/><rect x="11" y="3" width="6" height="6" rx="1.5"/><rect x="3" y="11" width="6" height="6" rx="1.5"/><rect x="11" y="11" width="6" height="6" rx="1.5"/>',
+        linked: '<path d="M8.5 11.5a3 3 0 0 1 0-4.2l2-2a3 3 0 0 1 4.2 4.2l-1 1"/><path d="M11.5 8.5a3 3 0 0 1 0 4.2l-2 2a3 3 0 0 1-4.2-4.2l1-1"/>',
+        picture: '<rect x="3" y="4" width="14" height="12" rx="2"/><circle cx="7.5" cy="8.5" r="1.5"/><path d="m4 14 4-3.5 3 2.5 2.5-2 2.5 3"/>',
+        bell: '<path d="M6 9a4 4 0 0 1 8 0c0 3 .8 4.2 1.5 5h-11C5.2 13.2 6 12 6 9Z"/><path d="M8.5 14.5a1.5 1.5 0 0 0 3 0"/>',
+        activity: '<circle cx="10" cy="10" r="7"/><path d="M10 6v4.2l2.6 1.8"/>',
+        download: '<path d="M10 3.5v9"/><path d="m6.5 9 3.5 3.5L13.5 9"/><path d="M4 15.5h12"/>',
+        close: '<path d="M6.5 6.5l7 7M13.5 6.5l-7 7"/>',
+        check: '<path d="m5.5 10.5 3 3 6-7"/>',
+        organization: '<rect x="3.5" y="7" width="13" height="9.5" rx="1.5"/><path d="M7.5 7V4.5h5V7"/><path d="M3.5 11h13"/>',
+        person: '<circle cx="10" cy="7" r="3.25"/><path d="M4 16.5c.8-3 3.2-4.5 6-4.5s5.2 1.5 6 4.5"/>',
+        authenticator: '<rect x="3" y="5.5" width="14" height="9" rx="2"/><path d="M6.5 10h.01M10 10h.01M13.5 10h.01"/>',
+        backup_codes: '<path d="M5.5 3.5h9v13h-9z"/><path d="M8 7h4M8 10h4M8 13h4"/>',
+        manage: '<path d="M10 2.5 3.5 5v5c0 3.4 2.7 6.2 6.5 7.5 3.8-1.3 6.5-4.1 6.5-7.5V5L10 2.5Z"/>'
+      }.freeze
+
+      def launch_url(client)
+        client.saml? && client.saml_idp_initiated? ? saml_initiate_path(client.client_id) : client.client_uri
+      end
+
+      def account_text(key, **options)
+        t("account.index.#{key}", **options)
+      end
+
+      def account_roster(organization)
+        organization.memberships.sort_by do |member|
+          [ member.pending? ? 1 : 0, member.owner? ? 0 : 1, Members.label(member).to_s.downcase ]
+        end
+      end
+
+      def account_member_since(member)
+        return [ "organizations.expired_ago", member.expires_at ] if member.expired?
+        return [ "organizations.invited_ago", member.invited_at ] if member.pending?
+
+        [ "organizations.joined_ago", member.created_at ]
+      end
+
+      def account_icon(name)
+        tag.svg(
+          ICONS.fetch(name).html_safe,
+          viewBox: "0 0 20 20",
+          fill: "none",
+          stroke: "currentColor",
+          "stroke-width": 1.4,
+          "stroke-linecap": "round",
+          "stroke-linejoin": "round",
+          "aria-hidden": true
+        )
+      end
+    end
+  end
+end

data/app/helpers/masks/server/application_helper.rb

@@ -0,0 +1,39 @@
+module Masks
+  module Server
+    module ApplicationHelper
+      def tenant_mark(tenant, size: 64)
+        return tag.span(tenant&.name.to_s.first&.upcase, class: "auth-mark", "aria-hidden": true) unless tenant&.logo_url
+
+        tag.img(src: tenant.logo_url(size: size), alt: "", class: "auth-mark auth-mark-logo")
+      end
+
+      def tenant_accent(tenant)
+        accent = tenant&.accent
+        return if accent.nil?
+
+        tag.style(<<~CSS.html_safe)
+          .auth-page {
+            --signal: #{accent};
+            --signal-ink: #{tenant.accent_ink};
+            --came: #{accent};
+            --brass: #{accent};
+            --ring: color-mix(in oklab, #{accent} 30%, transparent);
+          }
+        CSS
+      end
+      def vite_manifest
+        Server.engine? ? Server.vite_ruby.manifest : super
+      end
+
+      def flashed?(organization = nil)
+        flash[:organization] == organization&.key && (flash[:alert].present? || flash[:notice].present?)
+      end
+
+      private
+
+        def scope_key_by_partial(key)
+          super.sub(/\A(layouts\.)?masks\.server\./, '\1')
+        end
+    end
+  end
+end

data/app/helpers/masks/server/avatars_helper.rb

@@ -0,0 +1,20 @@
+module Masks
+  module Server
+    module AvatarsHelper
+      def avatar_tag(actor, style: nil, size: 96, **options)
+        resolved = style || (Avatars.held?(actor) ? Avatars::PHOTO : Avatars::FALLBACK)
+        stamp = Avatars.digest(actor, resolved)
+
+        if stamp.nil?
+          resolved = Avatars::FALLBACK
+          stamp = Avatars.digest(actor, resolved)
+        end
+
+        held = [ "avatar", "avatar-#{resolved}", options.delete(:class) ].compact.join(" ")
+
+        image_tag stamped_avatar_path(actor.uuid, resolved, stamp, size: Avatars.size(size)),
+                  width: size, height: size, alt: "", class: held, **options
+      end
+    end
+  end
+end

data/app/helpers/masks/server/events_helper.rb

@@ -0,0 +1,19 @@
+module Masks
+  module Server
+    module EventsHelper
+      WORRYING = (Event::GRAVE + [ Event::PASSWORD_RESET_REQUESTED ]).freeze
+
+      def event_said(event)
+        t("events.actions.#{event.action}", default: event.action)
+      end
+
+      def event_grave?(event)
+        WORRYING.include?(event.action)
+      end
+
+      def event_where(event)
+        [ event.device&.label, event.ip_address ].compact_blank.join(" · ")
+      end
+    end
+  end
+end

data/app/helpers/masks/server/scopes_helper.rb

@@ -0,0 +1,15 @@
+module Masks
+  module Server
+    module ScopesHelper
+      CONSEQUENTIAL = /(:write|:command|:exec|:delete|:admin)\z|\Aoffline_access\z|\Amasks:manage(:[a-z]+)?\z|\Amasks:delegate:./
+
+      def consequential_scope?(scope)
+        scope.to_s.match?(CONSEQUENTIAL)
+      end
+
+      def ranked_scopes(described)
+        described.to_a.partition { |scope, _| consequential_scope?(scope) }
+      end
+    end
+  end
+end

data/app/jobs/masks/server/application_job.rb

@@ -0,0 +1,7 @@
+module Masks
+  module Server
+    class ApplicationJob < ActiveJob::Base
+      include Tenancy::Job
+    end
+  end
+end

data/app/jobs/masks/server/backchannel_logout_job.rb

@@ -0,0 +1,38 @@
+module Masks
+  module Server
+    class BackchannelLogoutJob < ApplicationJob
+      queue_as :logout
+
+      retry_on BackchannelLogout::Refused, wait: :polynomially_longer, attempts: 5 do |job, error|
+        job.gave_up!(error)
+      end
+
+      def perform(client_id:, subject:, sid:, origin:, actor: nil)
+        client = Client.active.find_by(client_id: client_id)
+
+        return if client.nil? || !client.notified_on_logout?
+
+        issuer = Issuer.new(Current.tenant, origin)
+
+        BackchannelLogout.deliver!(
+          client,
+          issuer.logout_token(client: client, subject: subject, sid: sid)
+        )
+      end
+
+      def gave_up!(error)
+        held = arguments.first.to_h.symbolize_keys
+
+        Tenant.switch(held_tenant) do
+          Event.record!(
+            Event::LOGOUT_UNDELIVERED,
+            actor: Subjects.locate(held[:actor] || held[:subject]), by: nil,
+            client: Client.find_by(client_id: held[:client_id]),
+            device: nil, ip_address: nil, user_agent: nil,
+            said: error.message
+          )
+        end
+      end
+    end
+  end
+end

data/app/jobs/masks/server/check_domain_claims_job.rb

@@ -0,0 +1,31 @@
+module Masks
+  module Server
+    class CheckDomainClaimsJob < ApplicationJob
+      queue_as :maintenance
+      across_tenants!
+
+      def perform
+        Tenant.active.find_each do |tenant|
+          Tenant.switch(tenant) { check }
+        end
+      end
+
+      private
+
+        def check
+          DomainClaim.find_each do |claim|
+            was = claim.verified?
+
+            claim.check!
+
+            Event.record!(Event::DOMAIN_VERIFIED, by: nil, domain: claim.domain) if claim.verified? && !was
+            Event.record!(Event::DOMAIN_RELEASED, by: nil, domain: claim.domain, reason: "record gone") if was && !claim.verified?
+          rescue DomainClaim::Taken => e
+            ::Rails.logger.warn(e.message)
+          end
+
+          Current.tenant.unserve_uncovered!("record gone")
+        end
+    end
+  end
+end

data/app/jobs/masks/server/cleanup_job.rb

@@ -0,0 +1,53 @@
+module Masks
+  module Server
+    class CleanupJob < ApplicationJob
+      queue_as :maintenance
+      across_tenants!
+
+      GRACE = 7.days
+      BATCH = 10_000
+
+      class Incomplete < StandardError; end
+
+      def perform
+        failed = Tenant.active.find_each.filter_map do |tenant|
+          Tenant.switch(tenant) { sweep(tenant) }
+          nil
+        rescue StandardError => e
+          ::Rails.error.report(e, context: { tenant: tenant.subdomain })
+          tenant.subdomain
+        end
+
+        raise Incomplete, "cleanup failed for #{failed.join(', ')}" if failed.any?
+      end
+
+      private
+
+        def sweep(tenant)
+          cutoff = GRACE.ago
+
+          sweep_tokens(cutoff)
+          ended = Session.where(expires_at: ...cutoff).or(Session.where(revoked_at: ...cutoff))
+          ended.where.not(id: Token.live.where.not(session_id: nil).select(:session_id)).delete_all
+          SigningKey.where.not(retired_at: nil).where(retired_at: ...cutoff).delete_all
+          Event.where(created_at: ...tenant.event_retention.ago).in_batches(of: BATCH).delete_all
+          Members.purge_lapsed!
+        end
+
+        def sweep_tokens(cutoff)
+          loop do
+            roots = Token.group("COALESCE(root_id, id)")
+              .having("MAX(LEAST(consumed_at, expires_at)) < ?", cutoff)
+              .limit(BATCH).pluck(Arel.sql("COALESCE(root_id, id)"))
+            break if roots.empty?
+
+            Token.families(roots).delete_all
+          end
+
+          Token.where.not(kind: RefreshToken.sti_name).ended_before(cutoff)
+            .where.not(Token.where("children.parent_id = tokens.id").from("tokens children").arel.exists)
+            .in_batches(of: BATCH).delete_all
+        end
+    end
+  end
+end

data/app/jobs/masks/server/client_logo_job.rb

@@ -0,0 +1,20 @@
+module Masks
+  module Server
+    class ClientLogoJob < ApplicationJob
+      queue_as :maintenance
+
+      discard_on ActiveRecord::RecordNotFound
+
+      def perform(client_id)
+        client = Client.find(client_id)
+
+        ClientLogo.fetch!(client)
+      rescue Outbound::Refused, Pictures::Unreadable, URI::InvalidURIError => e
+        ClientLogo.forget(client)
+
+        Event.record!(Event::CLIENT_LOGO_REFUSED, actor: nil, by: nil, client: client, device: nil,
+                                                 ip_address: nil, user_agent: nil, said: e.message)
+      end
+    end
+  end
+end

data/app/jobs/masks/server/event_stream_job.rb

@@ -0,0 +1,40 @@
+module Masks
+  module Server
+    class EventStreamJob < ApplicationJob
+      queue_as :streams
+
+      retry_on EventStream::Refused, wait: :polynomially_longer, attempts: EventStream::ATTEMPTS do |job, error|
+        job.gave_up!(error)
+      end
+
+      def perform(stream_id, event_id)
+        stream = EventStream.active.find_by(id: stream_id)
+        event = Event.includes(:actor, :by, :client).find_by(id: event_id)
+
+        return if stream.nil? || event.nil?
+
+        stream.deliver!(event)
+        stream.delivered!
+      rescue EventStream::Refused => error
+        stream&.failed!(error.message)
+
+        raise
+      end
+
+      def gave_up!(error)
+        stream_id, event_id = arguments
+
+        Tenant.switch(held_tenant) do
+          stream = EventStream.find_by(id: stream_id)
+          event = Event.find_by(id: event_id)
+
+          Event.record!(
+            Event::STREAM_FAILED,
+            actor: nil, by: nil, device: nil, ip_address: nil, user_agent: nil,
+            stream: stream&.key, delivering: event&.action, said: error.message
+          )
+        end
+      end
+    end
+  end
+end

data/app/jobs/masks/server/idle_accounts_job.rb

@@ -0,0 +1,14 @@
+module Masks
+  module Server
+    class IdleAccountsJob < ApplicationJob
+      queue_as :maintenance
+      across_tenants!
+
+      def perform
+        Tenant.active.idling.find_each do |tenant|
+          Tenant.switch(tenant) { IdleAccounts.sweep(tenant) }
+        end
+      end
+    end
+  end
+end

data/app/jobs/masks/server/mail_delivery_job.rb

@@ -0,0 +1,7 @@
+module Masks
+  module Server
+    class MailDeliveryJob < ActionMailer::MailDeliveryJob
+      include Tenancy::Job
+    end
+  end
+end

data/app/jobs/masks/server/notification_job.rb

@@ -0,0 +1,17 @@
+module Masks
+  module Server
+    class NotificationJob < ApplicationJob
+      queue_as :mailers
+
+      def perform(event_id, origin: nil)
+        event = Event.includes(:actor, :client, :device, :by).find_by(id: event_id)
+
+        return if event.nil?
+
+        Current.origin ||= origin
+
+        Notifications.deliver(event)
+      end
+    end
+  end
+end

data/app/jobs/masks/server/refresh_authenticators_job.rb

@@ -0,0 +1,14 @@
+module Masks
+  module Server
+    class RefreshAuthenticatorsJob < ApplicationJob
+      queue_as :maintenance
+      across_tenants!
+
+      def perform(store: FidoMetadata::Store.new)
+        Authenticators.refresh!(store: store)
+      rescue Authenticators::Unreachable => e
+        ::Rails.logger.warn("authenticator metadata was not refreshed: #{e.message}")
+      end
+    end
+  end
+end

data/app/jobs/masks/server/refresh_saml_metadata_job.rb

@@ -0,0 +1,24 @@
+module Masks
+  module Server
+    class RefreshSamlMetadataJob < ApplicationJob
+      queue_as :maintenance
+      across_tenants!
+
+      def perform
+        Tenant.active.find_each do |tenant|
+          Tenant.switch(tenant) { refresh }
+        end
+      end
+
+      private
+
+        def refresh
+          Provider.active.where(protocol: Provider::SAML).where.not(metadata_url: [ nil, "" ]).find_each do |provider|
+            provider.refresh_metadata!
+          rescue Provider::Untrusted, Provider::Refused, Provider::Unreachable, ActiveRecord::RecordInvalid => e
+            ::Rails.logger.warn("saml metadata for #{provider.key} was not refreshed: #{e.message}")
+          end
+        end
+    end
+  end
+end

data/app/jobs/masks/server/rotate_signing_keys_job.rb

@@ -0,0 +1,37 @@
+module Masks
+  module Server
+    class RotateSigningKeysJob < ApplicationJob
+      queue_as :maintenance
+      across_tenants!
+
+      PUBLISHED_FOR = 1.day
+
+      def perform
+        Tenant.active.where.not(key_rotation_days: nil).find_each do |tenant|
+          Tenant.switch(tenant) { advance(tenant) }
+        end
+      end
+
+      private
+
+        def advance(tenant)
+          staged = SigningKey.staged.first
+
+          if staged
+            return unless staged.created_at <= PUBLISHED_FOR.ago
+
+            staged.activate!
+            Event.record!(Event::SIGNING_KEY_ACTIVATED, by: nil, kid: staged.kid, scheduled: true)
+          elsif due?(tenant)
+            staged = SigningKey.stage!(tenant: tenant)
+            Event.record!(Event::SIGNING_KEY_STAGED, by: nil, kid: staged.kid, scheduled: true)
+          end
+        end
+
+        def due?(tenant)
+          active = SigningKey.active.first
+          active.nil? || active.activated_at <= (tenant.key_rotation_days.days - PUBLISHED_FOR).ago
+        end
+    end
+  end
+end