masks-server 0.7.0

data/app/controllers/masks/server/addresses_controller.rb

@@ -0,0 +1,78 @@
+module Masks
+  module Server
+    class AddressesController < ApplicationController
+      rate_limit to: ::Rails.configuration.masks.account_attempt_limit,
+                 within: 3.minutes,
+                 by: -> { [ current_tenant.id, current_actor&.id ].join(":") },
+                 with: -> { refuse(t("addresses.too_many_attempts")) },
+                 only: :update
+
+      before_action :require_actor
+      before_action -> { reauthenticated!(anchor, t("addresses.again")) }
+      before_action :refuse_directed
+
+      def create
+        address = Addresses.normalize(channel, params[:address])
+
+        return refuse(t("addresses.#{channel}.invalid")) if address.nil?
+        return refuse(t("addresses.#{channel}.same")) if address.casecmp?(current_actor.public_send(channel).to_s)
+        return refuse(t("addresses.#{channel}.undeliverable")) unless Addresses.deliverable?(channel)
+        return refuse(t("addresses.too_many_requests")) if ConfirmationCode.crowded?(actor: current_actor, channel: channel)
+
+        token = Addresses.request!(current_actor, channel, address, journey: Journey.account(current_actor))
+        Addresses.hold(session, current_actor, channel, token)
+
+        redirect_to root_path(anchor: anchor), notice: t("addresses.#{channel}.sent", to: address)
+      end
+
+      def update
+        token = Addresses.pending(session, current_actor)[channel]
+
+        return refuse(t("addresses.expired")) if token.nil?
+
+        case Addresses.confirm!(current_actor, token, params[:code].to_s)
+        when :invalid then refuse(t("addresses.invalid_code"))
+        when :taken
+          Addresses.hold(session, current_actor, channel, nil)
+          refuse(t("addresses.#{channel}.taken"))
+        else
+          Addresses.hold(session, current_actor, channel, nil)
+          redirect_to root_path(anchor: anchor), notice: t("addresses.#{channel}.changed")
+        end
+      end
+
+      def destroy
+        return refuse(t("addresses.phone.none")) if current_actor.phone.blank?
+        return refuse(t("addresses.phone.required")) if SignInPolicy.for(tenant: current_tenant).requires?(:phone)
+
+        current_actor.update!(phone: nil, phone_verified_at: nil)
+        Addresses.hold(session, current_actor, channel, nil)
+        Event.record!(Event::PHONE_REMOVED, actor: current_actor)
+
+        redirect_to root_path(anchor: anchor), notice: t("addresses.phone.removed")
+      end
+
+      private
+
+        def channel
+          params[:channel].to_s
+        end
+
+        def anchor
+          channel == ConfirmationCode::PHONE ? "phone" : "email"
+        end
+
+        def require_actor
+          redirect_to login_path unless current_actor
+        end
+
+        def refuse_directed
+          refuse(t("addresses.directed")) if current_actor.directed?
+        end
+
+        def refuse(message)
+          redirect_to root_path(anchor: anchor), alert: message
+        end
+    end
+  end
+end

data/app/controllers/masks/server/application_controller.rb

@@ -0,0 +1,322 @@
+module Masks
+  module Server
+    class ApplicationController < ActionController::Base
+      include HoldsLogin
+
+      protect_from_forgery with: :exception
+
+      REQUESTS = "requests".freeze
+      HANDSHAKES = "handshakes".freeze
+      RETURN_TO = "masks_return_to".freeze
+      TRACKED = 5
+      UI_LOCALES = "masks_ui_locales".freeze
+
+      content_security_policy do |policy|
+        policy.default_src :self
+        policy.base_uri :none
+        policy.object_src :none
+        policy.frame_ancestors :none
+        policy.script_src :self
+        policy.style_src :self, :unsafe_inline
+        policy.img_src :self, :data
+        policy.font_src :self, :data
+        policy.connect_src(*([ :self ] + (::Rails.env.development? ? %i[ws wss http] : [])))
+      end
+
+      around_action :in_locale
+      before_action :withhold_referrer
+      before_action :refuse_blocked_device
+
+      helper_method :current_actor, :current_tenant, :current_device, :hid_for, :themed_client
+
+      rescue_from Policy::Denied, with: :policy_denied
+
+      def translate(key, **options)
+        if key.to_s.start_with?(".")
+          path = controller_path.delete_prefix("masks/server/").tr("/", ".")
+          options[:default] = [ :"#{path}#{key}", *options[:default] ]
+          key = "#{path}.#{action_name}#{key}"
+        end
+
+        super(key, **options)
+      end
+      alias t translate
+
+      private
+
+        def current_tenant
+          Current.tenant
+        end
+
+        def no_store!
+          response.headers["Cache-Control"] = "no-store"
+          response.headers["Pragma"] = "no-cache"
+        end
+
+        def themed_client
+          @login&.client
+        end
+
+        def withhold_referrer
+          response.headers["Referrer-Policy"] = "same-origin"
+        end
+
+        def in_locale
+          session[UI_LOCALES] = params[:ui_locales].to_s[0, 100] if params[:ui_locales].present?
+          locale = Locales.negotiate(request.headers["Accept-Language"], asked: session[UI_LOCALES])
+
+          I18n.with_locale(locale) { yield }
+
+          response.headers["Content-Language"] = Locales.tag(locale)
+          response.headers["Vary"] =
+            [ response.headers["Vary"].presence, "Accept-Language" ].compact.join(", ")
+        end
+
+        def issuer
+          @issuer ||= Issuer.new(current_tenant, Current.origin)
+        end
+
+        def current_session
+          return @current_session if defined?(@current_session)
+
+          @current_session = Session.resume(cookies.encrypted[:masks_session])
+        end
+
+        def current_actor
+          current_session&.actor
+        end
+
+        def current_device
+          return @current_device if defined?(@current_device)
+
+          held = cookies.signed[Device::COOKIE].presence
+
+          @current_device = held && recognise(held)
+        end
+
+        def establish_device
+          return refuse_blocked_agent if blocked_agent?
+
+          @current_device = recognise(cookies.signed[Device::COOKIE].presence)
+        end
+
+        def blocked_agent?
+          current_tenant&.refuses?(request.user_agent)
+        end
+
+        def refuse_blocked_agent
+          return unless blocked_agent?
+
+          refuse_request(:agent, t("devices.refused_agent"))
+        end
+
+        def refuse_blocked_device
+          return unless current_device&.blocked?
+
+          refuse_request(:device, t("devices.blocked"), device: current_device)
+        end
+
+        def refuse_request(refusal, said, device: nil)
+          return render plain: said, status: :forbidden unless request.format.html?
+
+          @refusal = refusal
+          @device_label = device&.label
+
+          render "masks/server/refusals/show", status: :forbidden
+        end
+
+        def recognise(public_id)
+          device = Device.identify(
+            public_id,
+            user_agent: request.user_agent,
+            ip_address: request.remote_ip
+          )
+
+          cookies.signed[Device::COOKIE] = {
+            value: device.public_id,
+            expires: Device::LIFETIME.from_now,
+            httponly: true,
+            same_site: :lax,
+            secure: request.ssl?
+          }
+
+          Current.device = device
+        end
+
+        def sign_in(actor, amr: [], policy: nil, first_factor: {})
+          carried = session.to_hash.slice(REQUESTS, HANDSHAKES, "login", RETURN_TO)
+          reset_session
+          carried.each { |key, value| session[key] = value }
+
+          device = establish_device
+
+          record = Session.start!(
+            actor: actor,
+            device: device,
+            user_agent: request.user_agent,
+            ip_address: request.remote_ip,
+            amr: amr,
+            policy: policy,
+            first_factor: first_factor
+          )
+
+          cookies.encrypted[:masks_session] = {
+            value: record.secret,
+            expires: record.expires_at,
+            httponly: true,
+            same_site: :lax,
+            secure: request.ssl?
+          }
+
+          actor.update!(last_login_at: Time.current)
+
+          Event.record!(Event::SESSION_STARTED, actor: actor, device: device, amr: amr.presence)
+
+          @current_session = record
+        end
+
+        def sign_out
+          ended = current_session
+
+          ended&.revoke!
+          cookies.delete(:masks_session)
+          @current_session = nil
+
+          Event.record!(Event::SESSION_ENDED, actor: ended.actor) if ended
+        end
+
+        def reauthenticated!(anchor, notice)
+          return true if current_session.fresh?
+
+          sign_out
+          redirect_to login_path(return_to: root_path(anchor: anchor)), notice: notice
+          false
+        end
+
+        def tracked(key)
+          session[key] ||= {}
+        end
+
+        def track!(key, model, subject)
+          held = tracked(key)[subject.fingerprint]
+          existing = held && model.spent(held)
+
+          return existing if existing&.live?
+          return existing if existing&.consumed? && model.answered_is_final?
+
+          opened = model.open!(subject)
+          session[key] = tracked(key).merge(subject.fingerprint => opened.secret).to_a.last(TRACKED).to_h
+
+          opened
+        end
+
+        def id_for(key, pending)
+          tracked(key)[pending.fingerprint] || pending.secret
+        end
+
+        def pending_for(key, model, id)
+          return nil if id.blank?
+          return nil unless tracked(key).value?(id)
+
+          model.redeem(id)
+        end
+
+        def track_request!(authorization)
+          track!(REQUESTS, PendingRequest, authorization)
+        end
+
+        def rid_for(pending)
+          id_for(REQUESTS, pending)
+        end
+
+        def pending_request(rid)
+          pending_for(REQUESTS, PendingRequest, rid)
+        end
+
+        def track_handshake!(handshake)
+          track!(HANDSHAKES, PendingHandshake, handshake)
+        end
+
+        def hid_for(pending)
+          id_for(HANDSHAKES, pending)
+        end
+
+        def pending_handshake(hid)
+          pending_for(HANDSHAKES, PendingHandshake, hid)
+        end
+
+        def latest_handshake
+          held = tracked(HANDSHAKES).values.last
+
+          held && PendingHandshake.redeem(held)
+        end
+
+        def handshake_url_for(pending)
+          "#{handshake_path}?#{URI.encode_www_form(pending.handshake.query_pairs)}"
+        end
+
+        def deny(pending, error, description)
+          PendingRequest.claim(rid_for(pending))
+
+          pending.authorization.redirect_with(
+            issuer: issuer, error: error, error_description: description
+          )
+        end
+
+        def authorize_url_for(pending)
+          "#{authorize_path}?#{URI.encode_www_form(pending.authorization.query_pairs)}"
+        end
+
+        def device_url_for(pending)
+          device_verification_path(user_code: UserCodes.spaced(pending.held("user_code")))
+        end
+
+        def refuse_device(pending, grant = DeviceGrant.awaiting(pending.held("user_code")))
+          PendingRequest.claim(rid_for(pending))
+          grant&.refuse!(by: current_actor)
+
+          device_verification_path(refused: DeviceVerificationsController::DECLINED)
+        end
+
+        def refuse_saml(pending)
+          PendingRequest.claim(rid_for(pending))
+
+          saml_refused_path(rid: rid_for(pending))
+        end
+
+        def advance(pending)
+          Login.new(
+            store: login_store,
+            request: pending,
+            session: current_session,
+            device: current_device,
+            rid: rid_for(pending)
+          ).update
+        end
+
+        def prompt(login)
+          @login = login
+
+          render template: "masks/server/logins/show"
+        end
+
+        def settle!(login)
+          hold(login.actor, amr: login.amr, policy: login.policy, first_factor: login.first_factored_by)
+          forget_login
+        end
+
+        def hold(actor, amr: [], policy: nil, first_factor: {})
+          return if actor.nil?
+          return current_session.first_factored!(first_factor) if current_session&.actor_id == actor.id
+
+          sign_out if current_session
+
+          sign_in(actor, amr: amr, policy: policy, first_factor: first_factor)
+        end
+
+        def policy_denied(denial)
+          render json: denial.to_h, status: denial.status
+        end
+    end
+  end
+end

data/app/controllers/masks/server/apps_controller.rb

@@ -0,0 +1,37 @@
+module Masks
+  module Server
+    class AppsController < ApplicationController
+      before_action :require_actor
+
+      def destroy
+        client = Client.find_by(client_id: params[:client_id])
+
+        return redirect_to root_path, alert: t("apps.unknown") if client.nil?
+
+        consent = Consent.live.find_by(actor: current_actor, client: client)
+        scopes = Apps.held_by(current_actor).find { |app| app.client.id == client.id }&.scope_list
+
+        consent&.revoke!
+
+        Delegation.live.where(actor: current_actor, client: client).find_each do |delegation|
+          delegation.revoke!(reason: "access for #{client.name} revoked by #{current_actor.identifier}", by: current_actor)
+        end
+
+        Token.live.where(actor: current_actor, client: client).find_each(&:revoke!)
+
+        Event.record!(
+          Event::CONSENT_REVOKED,
+          actor: current_actor, client: client, scopes: scopes || []
+        )
+
+        redirect_to root_path, notice: t("apps.revoked", client: client.name)
+      end
+
+      private
+
+        def require_actor
+          redirect_to login_path unless current_actor
+        end
+    end
+  end
+end

data/app/controllers/masks/server/authenticator_apps_controller.rb

@@ -0,0 +1,53 @@
+module Masks
+  module Server
+    class AuthenticatorAppsController < ApplicationController
+      rate_limit to: ::Rails.configuration.masks.account_attempt_limit,
+                 within: 3.minutes,
+                 by: -> { [ current_tenant.id, current_actor&.id ].join(":") },
+                 with: -> { refuse(t("authenticator_apps.too_many_attempts")) },
+                 only: :create
+
+      before_action :require_actor
+      before_action -> { reauthenticated!("authenticator", t("authenticator_apps.again")) }
+
+      def create
+        return refuse(t("authenticator_apps.already")) if current_actor.otp?
+        return refuse(t("authenticator_apps.unoffered")) unless AuthenticatorApp.offered?(current_actor)
+
+        secret = AuthenticatorApp.setup_secret(session, current_actor)
+
+        return refuse(t("authenticator_apps.invalid_code")) unless current_actor.adopt_otp!(secret, params[:code].to_s)
+
+        session.delete(AuthenticatorApp::HELD)
+        Event.record!(Event::AUTHENTICATOR_ENABLED, actor: current_actor)
+
+        if AuthenticatorApp.backup_codes_offered?(current_actor) && !current_actor.backup_codes?
+          codes = current_actor.generate_backup_codes!
+          Event.record!(Event::BACKUP_CODES_GENERATED, actor: current_actor, count: codes.length)
+          flash[:backup_codes] = codes
+        end
+
+        redirect_to root_path(anchor: "authenticator"), notice: t("authenticator_apps.added")
+      end
+
+      def destroy
+        return refuse(t("authenticator_apps.none")) unless current_actor.otp?
+
+        AuthenticatorApp.remove!(current_actor)
+        Event.record!(Event::AUTHENTICATOR_DISABLED, actor: current_actor)
+
+        redirect_to root_path(anchor: "authenticator"), notice: t("authenticator_apps.removed")
+      end
+
+      private
+
+        def require_actor
+          redirect_to login_path unless current_actor
+        end
+
+        def refuse(message)
+          redirect_to root_path(anchor: "authenticator"), alert: message
+        end
+    end
+  end
+end

data/app/controllers/masks/server/authorize_controller.rb

@@ -0,0 +1,197 @@
+module Masks
+  module Server
+    class AuthorizeController < ApplicationController
+      include RackOAuth2Endpoint
+
+      skip_forgery_protection only: :show, if: -> { request.post? }
+
+      rescue_from RequestObject::Refused do |refusal|
+        refuse(bad_request(:invalid_request_object, refusal.message))
+      end
+
+      def show
+        authorization = Authorization.from_request(request)
+
+        if authorization.request_uri? && authorization.request_object?
+          return refuse(bad_request(:invalid_request, "request and request_uri cannot both be sent"))
+        end
+
+        if authorization.request_uri?
+          return refuse(unsupported_request_uri) unless PushedRequest.urn?(authorization.request_uri)
+
+          pushed = PushedRequest.claim_urn(authorization.request_uri, client: authorization.client)
+          return refuse(invalid_request_uri) if pushed.nil?
+
+          authorization = pushed.authorization
+        else
+          if authorization.request_object?
+            authorization = RequestObject.unpack!(authorization, issuer: issuer)
+          end
+
+          client = authorization.client
+          admitted = admitted?(authorization)
+
+          return refuse(pushing_required) if client&.require_pushed_authorization_requests? && !admitted
+          return refuse(signing_required) if client&.require_signed_request_object? && !authorization.signed? && !admitted
+        end
+
+        attempt = validate(authorization)
+
+        return refuse(attempt.error) if attempt.refused?
+        return redirect_to(attempt.location, allow_other_host: true) if attempt.answered?
+
+        pending = track_request!(authorization)
+        return spent(pending) if pending.consumed?
+
+        login = advance(pending)
+
+        return answer(deny(pending, login.refusal.error, login.refusal.description)) if login.refused?
+        return interaction_required(pending) if login.prompted? && pending.silent?
+        return redirect_to(login.redirect_to, allow_other_host: true) if login.redirect_to.present?
+        return prompt(login) unless login.settled?
+
+        complete(pending, attempt, login)
+      end
+
+      private
+
+        def validate(authorization)
+          AuthorizeRequest.new(authorization.to_params).run do |req, res|
+            req.unsupported_response_type! unless req.response_type == :code
+
+            client = Client.authenticating(req.client_id)
+            req.bad_request!(:invalid_client, unknown_client(req.client_id)) if client.nil?
+            req.invalid_request!("redirect_uri is required") if req.redirect_uri.blank?
+
+            req.verify_redirect_uri!(client.redirect_uris)
+            req.verified_redirect_uri = with_issuer(req.verified_redirect_uri)
+            res.redirect_uri = req.verified_redirect_uri
+
+            permit(req) { authorization.validate! }
+          end
+        end
+
+        def unknown_client(client_id)
+          if ClientMetadataDocument.url?(client_id)
+            "the client metadata document at that client_id could not be fetched or is not one masks accepts"
+          else
+            "no client is registered with that client_id"
+          end
+        end
+
+        def permit(req)
+          yield
+        rescue Policy::Denied => denial
+          raise unless denial.redirectable
+
+          req.bad_request!(denial.error.to_sym, denial.description)
+        end
+
+        def complete(pending, attempt, login)
+          claimed = PendingRequest.claim(rid_for(pending))
+          return spent(pending) if claimed.nil?
+
+          settle!(login)
+
+          code = claimed.issue_code!(
+            actor: current_actor,
+            device: current_device,
+            session: current_session,
+            authenticated_at: login.authenticated_at || current_session&.authenticated_at,
+            amr: login.amr.presence || current_session&.amr,
+            organization: login.state("organization-choice").selected
+          )
+
+          render_rack(attempt.approve!(code.secret))
+        end
+
+        def spent(pending)
+          answer(deny(pending, "invalid_request", "that sign-in request has already been answered"))
+        end
+
+        def interaction_required(pending)
+          answer(deny(pending, "interaction_required", "this request cannot be answered without asking the person"))
+        end
+
+        def answer(location)
+          redirect_to location, allow_other_host: true
+        end
+
+        def refuse(error)
+          client = Client.authenticating(params[:client_id])
+          target = params[:redirect_uri].to_s
+
+          if target.present? && (client&.redirect_uri?(target) || ours?(target))
+            return redirect_to refusal_uri(target, error), allow_other_host: true
+          end
+
+          @error_code = error.error.to_s
+          @error_description = error.description
+
+          respond_to do |format|
+            format.html { render :error, status: error.status }
+            format.any do
+              render json: {
+                "error" => @error_code,
+                "error_description" => @error_description
+              }, status: error.status
+            end
+          end
+        end
+
+        def admitted?(authorization)
+          tracked(REQUESTS).key?(authorization.fingerprint)
+        end
+
+        def unsupported_request_uri
+          bad_request(:request_uri_not_supported, "request_uri is only supported for a pushed authorization request")
+        end
+
+        def invalid_request_uri
+          bad_request(:invalid_request_uri, "that request_uri is unknown, has expired, or has already been used")
+        end
+
+        def pushing_required
+          bad_request(:invalid_request, "this client has to push its authorization request before sending anyone here")
+        end
+
+        def signing_required
+          bad_request(:invalid_request, "this client has to sign its authorization requests")
+        end
+
+        def bad_request(error, description)
+          Rack::OAuth2::Server::Authorize::BadRequest.new(error, description)
+        end
+
+        def ours?(target)
+          here = URI.parse(issuer.url)
+          there = URI.parse(target.to_s)
+
+          there.scheme == here.scheme && there.host == here.host && there.port == here.port
+        rescue URI::InvalidURIError
+          false
+        end
+
+        def refusal_uri(target, error)
+          uri = URI.parse(with_issuer(target))
+          query = Rack::Utils.parse_query(uri.query)
+
+          query["error"] = error.error.to_s
+          query["error_description"] = error.description
+          query["state"] = params[:state] if params[:state].present?
+
+          uri.query = Rack::Utils.build_query(query)
+          uri.to_s
+        end
+
+        def with_issuer(uri)
+          parsed = URI.parse(uri.to_s)
+          query = Rack::Utils.parse_query(parsed.query)
+          query["iss"] = issuer.url
+          parsed.query = Rack::Utils.build_query(query)
+
+          parsed.to_s
+        end
+    end
+  end
+end