masks-server 0.7.0

data/app/logins/masks/server/login_states/confirmation.rb

@@ -0,0 +1,193 @@
+module Masks
+  module Server
+    module LoginStates
+      class Confirmation < LoginState
+        HELD = "confirmation".freeze
+
+        CHANNELS = {
+          ConfirmationCode::EMAIL => { verified: :email_verified_at, event: Event::EMAIL_VERIFIED },
+          ConfirmationCode::PHONE => { verified: :phone_verified_at, event: Event::PHONE_VERIFIED }
+        }.freeze
+
+        accepts :code, :phone
+
+        handles "confirm:email", limit: :verifying do
+          verify(ConfirmationCode::EMAIL)
+        end
+
+        handles "confirm:phone", limit: :verifying do
+          verify(ConfirmationCode::PHONE)
+        end
+
+        handles "confirm:resend", limit: :sending do
+          resend
+        end
+
+        handles "confirm:add-phone" do
+          add_phone
+        end
+
+        handles "confirm:change-phone" do
+          change_phone
+        end
+
+        handles "confirm:check" do
+          actor&.reload
+        end
+
+        prompts "awaiting-approval" do
+          actor.pending_approval_at.present?
+        end
+
+        prompts "add-phone" do
+          phone_missing?
+        end
+
+        prompts "confirm-email" do
+          open!(ConfirmationCode::EMAIL) unless email_mode == "link"
+          unconfirmed?(ConfirmationCode::EMAIL)
+        end
+
+        prompts "confirm-phone" do
+          open!(ConfirmationCode::PHONE)
+          unconfirmed?(ConfirmationCode::PHONE)
+        end
+
+        def enabled?
+          actor.present? && login.first_factored? && !login.second_factor_pending? &&
+            (actor.pending_approval_at.present? || phone_missing? || CHANNELS.keys.any? { |channel| unconfirmed?(channel) })
+        end
+
+        def as_json
+          {
+            "confirmation" => {
+              "email" => actor.email,
+              "phone" => actor.phone,
+              "mode" => email_mode,
+              "mails" => ActorMailer.deliverable?,
+              "texts" => Texting.deliverable?,
+              "resendable" => CHANNELS.keys.all? { |channel| resendable?(channel) }
+            }
+          }
+        end
+
+        def start_over!
+          login.store.delete(HELD)
+        end
+
+        private
+
+          def policy
+            login.policy
+          end
+
+          def held
+            stored = login.store[HELD]
+
+            stored.present? && stored["actor_id"] == actor.id ? stored : { "actor_id" => actor.id }
+          end
+
+          def email_mode
+            policy.confirmation == SignInPolicy::LINK && actor.signed_up_at.present? ? "link" : ConfirmationCode::EMAIL
+          end
+
+          def unconfirmed?(channel)
+            return false if actor.public_send(channel).blank? || actor.public_send(CHANNELS[channel][:verified]).present?
+
+            if channel == ConfirmationCode::EMAIL
+              policy.email_verified ||
+                (actor.signed_up_at.present? && [ SignInPolicy::CODE, SignInPolicy::LINK ].include?(policy.confirmation))
+            else
+              policy.asks?(:phone) && policy.phone_verified
+            end
+          end
+
+          def phone_missing?
+            policy.requires?(:phone) && actor.phone.blank?
+          end
+
+          def token_for(channel)
+            @tokens ||= {}
+
+            return @tokens[channel] if @tokens.key?(channel)
+
+            id = held[channel]
+            token = id && ConfirmationCode.find_by(id: id, actor_id: actor.id)
+
+            @tokens[channel] = token&.live? && token.channel == channel ? token : nil
+          end
+
+          def resendable?(channel)
+            token_for(channel)&.resendable? != false
+          end
+
+          def open!(channel)
+            return unless unconfirmed?(channel)
+            return if token_for(channel) || held["#{channel}_sent"].present?
+
+            send_code(channel)
+          end
+
+          def send_code(channel)
+            token = Confirmations.send_code(actor, channel, journey: Masks::Server::Journey.sign_in(login))
+
+            @tokens&.delete(channel)
+            login.store[HELD] = held.merge(channel => token.id, "#{channel}_sent" => Time.current.to_i)
+          end
+
+          def forget!(channel)
+            @tokens&.delete(channel)
+            login.store[HELD] = held.except(channel, "#{channel}_sent")
+          end
+
+          def verify(channel)
+            token = token_for(channel)
+
+            return warn!("confirmation-expired") if token.nil?
+
+            if token.verify(update(:code)) && token.address == actor.public_send(channel)
+              actor.update!(CHANNELS[channel][:verified] => Time.current)
+
+              Event.record!(CHANNELS[channel][:event], actor: actor)
+
+              forget!(channel)
+            else
+              @tokens.delete(channel)
+              refused! "confirm_#{channel}"
+              warn! "invalid-code"
+            end
+          end
+
+          def resend
+            if unconfirmed?(ConfirmationCode::EMAIL)
+              if email_mode == "link"
+                Verifications.open(actor: actor, journey: Masks::Server::Journey.sign_in(login))
+              elsif resendable?(ConfirmationCode::EMAIL)
+                send_code(ConfirmationCode::EMAIL)
+              end
+            end
+
+            send_code(ConfirmationCode::PHONE) if unconfirmed?(ConfirmationCode::PHONE) && resendable?(ConfirmationCode::PHONE)
+          end
+
+          def change_phone
+            return unless unconfirmed?(ConfirmationCode::PHONE)
+
+            actor.update!(phone: nil, phone_verified_at: nil)
+            forget!(ConfirmationCode::PHONE)
+          end
+
+          def add_phone
+            return unless phone_missing? || unconfirmed?(ConfirmationCode::PHONE)
+
+            number = Senders::Sms.number(update(:phone))
+
+            return warn!("invalid-phone", field: "phone") if number.nil?
+            return warn!("invalid-account", field: "phone") unless actor.update(phone: number, phone_verified_at: nil)
+
+            forget!(ConfirmationCode::PHONE)
+          end
+      end
+    end
+  end
+end

data/app/logins/masks/server/login_states/consent.rb

@@ -0,0 +1,90 @@
+module Masks
+  module Server
+    module LoginStates
+      class Consent < LoginState
+        EXPIRY = 1.hour
+
+        accepts :approve
+
+        def enabled?
+          request.present?
+        end
+
+        handles "consent" do
+          record if login.first_factored? && !login.second_factor_pending?
+        end
+
+        handles "decline" do
+          refuse!("access_denied", "the person signing in declined")
+        end
+
+        prompts "consent" do
+          required?
+        end
+
+        def as_json
+          return {} unless required?
+
+          {
+            "consent" => {
+              "scopes" => ResourceMetadata.describe(audience, scopes),
+              "audience" => audience,
+              "details" => details&.described
+            }.compact
+          }
+        end
+
+        def start_over!
+          expire! :consent
+        end
+
+        def required?
+          return false if consented_here?
+          return true if request.consent?
+          return true if login.state("delegation").undelegated.any?
+          return false if details.nil? && client && !client.consent_required?
+
+          !Masks::Server::Consent.covers?(
+            actor: actor, client: client, scopes: scopes, audience: audience, details: details
+          )
+        end
+
+        def scopes
+          request.scopes_for(actor)
+        end
+
+        def audience
+          request.audience
+        end
+
+        def details
+          return @details if defined?(@details)
+
+          @details = AuthorizationDetails.parse(request.authorization_details)
+        end
+
+        def consented_here?
+          touched?(:consent) && login.factors.dig("consent", "rid") == login.rid.to_s
+        end
+
+        private
+
+          def record
+            return refuse!("access_denied", "the person signing in declined") if update(:approve).blank?
+
+            Masks::Server::Consent.record!(
+              actor: actor, client: client, scopes: scopes, audience: audience, details: details
+            )
+
+            Event.record!(
+              Event::CONSENT_GRANTED,
+              actor: actor, client: client, scopes: scopes, audience: audience.presence,
+              authorization_details: details&.types
+            )
+
+            factored!(:consent, expiry: EXPIRY)["rid"] = login.rid.to_s
+          end
+      end
+    end
+  end
+end

data/app/logins/masks/server/login_states/delegation.rb

@@ -0,0 +1,172 @@
+module Masks
+  module Server
+    module LoginStates
+      class Delegation < LoginState
+        HELD = "delegation_handoff".freeze
+        WINDOW = 15.minutes
+
+        accepts :provider, :code, :state, :error, :error_description, :user
+
+        handles "delegation:callback" do
+          finish
+        end
+
+        def self.pending?(store, params)
+          Linking.answers?(store[HELD], params["state"])
+        end
+
+        def enabled?
+          request.present? && !request.device? && actor.present? && wanted.any?
+        end
+
+        def factor!
+          return unless enabled?
+
+          refuse!("unauthorized_client", "only an approved client can be trusted with somebody's account elsewhere") unless client&.approved?
+
+          missing = wanted.select { |_, provider| provider.nil? }.map(&:first)
+          refuse!("invalid_scope", "#{missing.join(', ')} names no provider that lets applications use it") if missing.any?
+
+          return unless login.state("consent").consented_here?
+
+          grant!
+
+          waiting = unconnected.first
+
+          return if waiting.nil?
+
+          if login.redirect_to.present?
+            prompt!("consent")
+          elsif login.store[HELD].present? || request.silent?
+            login.store.delete(HELD)
+            expire!(:consent)
+          else
+            start(waiting)
+            prompt!("consent")
+          end
+        end
+
+        def reload!
+          @wanted = nil
+          @connections = nil
+        end
+
+        def cleanup!
+          held = login.store[HELD]
+
+          login.store.delete(HELD) if held && held["expires_at"].to_i <= Time.current.to_i
+        end
+
+        def start_over!
+          login.store.delete(HELD)
+        end
+
+        def undelegated
+          return [] unless enabled?
+
+          wanted.reject do |_, provider|
+            connection = provider && connection_for(provider)
+
+            connection && Masks::Server::Delegation.covering(client: client, actor: actor, connection: connection)
+          end
+        end
+
+        private
+
+          def wanted
+            return [] if request.nil? || actor.nil?
+
+            @wanted = nil unless @wanted_for == actor.id
+            @wanted_for = actor.id
+            @wanted ||= begin
+              scopes = Scopes.delegations(request.scopes_for(actor))
+              found = Masks::Server::Provider.delegating.where(key: scopes.map { |scope| Scopes.delegated_provider(scope) }).index_by(&:key)
+
+              scopes.map { |scope| [ scope, found[Scopes.delegated_provider(scope)] ] }
+            end
+          end
+
+          def unconnected
+            wanted.filter_map { |_, provider| provider if provider && connection_for(provider).nil? }
+          end
+
+          def connection_for(provider)
+            @connections ||= {}
+            @connections.fetch([ actor.id, provider.id ]) do
+              @connections[[ actor.id, provider.id ]] =
+                Masks::Server::Connection.live.where(provider: provider, actor: actor).order(connected_at: :desc).find(&:delegable?)
+            end
+          end
+
+          def grant!
+            wanted.each do |_, provider|
+              connection = connection_for(provider)
+
+              Masks::Server::Delegation.grant!(client: client, actor: actor, connection: connection) if connection
+            end
+          end
+
+          def start(provider)
+            location, handoff = provider.federation.start(callback: provider.callback_url, delegated: true)
+
+            login.store[HELD] = handoff.merge(
+              "provider_id" => provider.id,
+              "actor_id" => actor.id,
+              "rid" => login.rid,
+              "expires_at" => WINDOW.from_now.to_i
+            )
+
+            login.redirect_to = location
+          end
+
+          def finish
+            held = login.store.delete(HELD)
+
+            refuse!("access_denied", "connecting took too long; try again") if held.blank? || held["expires_at"].to_i <= Time.current.to_i
+            refuse!("access_denied", "connecting was started by somebody else") unless actor && actor.id == held["actor_id"]
+
+            provider = Masks::Server::Provider.delegating.find_by(id: held["provider_id"])
+
+            refuse!("access_denied", "that provider is no longer available") if provider.nil? || provider.key != update(:provider).to_s
+
+            identity = provider.federation.finish(login.updates, handoff: held, callback: provider.callback_url)
+
+            connect!(provider, identity, provider.federation.tokens)
+          rescue Masks::Server::Provider::Untrusted, Masks::Server::Provider::Refused, Masks::Server::Provider::Unreachable, Masks::Server::Delegation::Refused, ArgumentError => e
+            Event.record!(Event::DELEGATION_REFUSED, actor: actor, by: nil, client: client, provider: provider&.key, reason: e.message)
+
+            refuse!("access_denied", "#{provider&.name || 'the provider'} did not connect: #{e.message}")
+          end
+
+          def connect!(provider, identity, tokens)
+            subject = identity["sub"].presence || (provider.mcp? ? "masks:#{actor.uuid}" : nil)
+
+            raise Masks::Server::Provider::Untrusted, "#{provider.name} did not say which account that was" if subject.nil?
+
+            taken = Masks::Server::Connection.live.find_by(provider: provider, subject: subject.to_s)
+            mine = Masks::Server::Connection.live.where(provider: provider, actor: actor)
+
+            raise Masks::Server::Delegation::Refused, "that #{provider.name} account is connected to somebody else here" if taken && taken.actor_id != actor.id
+
+            if taken.nil? && mine.exists?
+              raise Masks::Server::Delegation::Refused, "that is not the #{provider.name} account connected to you here"
+            end
+
+            if taken.nil? && provider.signs_in? && (login.authenticated_at.nil? || login.authenticated_at < Session::FRESHNESS.ago)
+              Event.record!(Event::DELEGATION_REFUSED, actor: actor, by: nil, client: client, provider: provider.key, reason: "stale sign-in")
+
+              refuse!("login_required", "sign in again before connecting a #{provider.name} account for the first time")
+            end
+
+            connection = Masks::Server::Connection.record!(provider: provider, actor: actor, identity: identity.merge("sub" => subject))
+            connection.hold!(tokens)
+            @connections = nil
+
+            Event.record!(Event::CONNECTION_LINKED, actor: actor, by: nil, provider: provider.key) if taken.nil?
+
+            connection
+          end
+      end
+    end
+  end
+end

data/app/logins/masks/server/login_states/email_code.rb

@@ -0,0 +1,108 @@
+module Masks
+  module Server
+    module LoginStates
+      class EmailCode < LoginState
+        HELD = "email_code".freeze
+        CHANNEL = "email_sign_in".freeze
+        EXPIRY = 12.hours
+
+        accepts :code
+
+        handles "email-code:send", limit: :sending do
+          send_code
+        end
+
+        handles "email-code:verify", limit: :verifying do
+          verify
+        end
+
+        prompts "email-code" do
+          sent? && !login.first_factored?
+        end
+
+        def enabled?
+          return @enabled if defined?(@enabled)
+
+          @enabled = login.policy.first_factor?(:email_code) && ActorMailer.deliverable?
+        end
+
+        def as_json
+          { "emailCode" => { "sent" => sent?, "resendable" => resendable? } }
+        end
+
+        def start_over!
+          login.store.delete(HELD)
+        end
+
+        private
+
+          def held
+            stored = login.store[HELD]
+
+            stored.present? && stored["identifier"] == login.identifier ? stored : {}
+          end
+
+          def sent?
+            held["sent"].present?
+          end
+
+          def resendable?
+            held["sent"].to_i <= ConfirmationCode::RESEND_AFTER.ago.to_i
+          end
+
+          def candidate
+            found = Masks::Server::Actor.locate(login.identifier)
+
+            found if found&.email.present? && found.activated? && (found.email_verified_at.present? || !found.password?)
+          end
+
+          def token
+            return @token if defined?(@token)
+
+            id = held["token_id"]
+            found = id && Masks::Server::ConfirmationCode.find_by(id: id)
+
+            @token = found&.live? && found.channel == CHANNEL ? found : nil
+          end
+
+          def send_code
+            return warn!("missing-identifier") if login.identifier.blank?
+            return warn!("prove-email-first") if login.state("inbox").pending?
+            return if sent? && !resendable?
+
+            actor = candidate
+            stored = { "identifier" => login.identifier, "sent" => Time.current.to_i }
+
+            if actor && !Masks::Server::ConfirmationCode.crowded?(actor: actor, channel: CHANNEL)
+              opened, code = Masks::Server::ConfirmationCode.open!(actor: actor, channel: CHANNEL, address: actor.email)
+              Masks::Server::Confirmations.deliver(ConfirmationCode::EMAIL, actor.email, code,
+                                                   journey: Masks::Server::Journey.sign_in(login))
+              stored["token_id"] = opened.id
+            end
+
+            login.store[HELD] = stored
+          end
+
+          def verify
+            return warn!("prove-email-first") if login.state("inbox").pending?
+            return warn!("confirmation-expired") unless sent?
+
+            unless token&.verify(update(:code))
+              refused! "email-code"
+              return warn!("invalid-code")
+            end
+
+            actor = token.actor
+
+            login.actor = actor
+            factored! :first_factor, expiry: EXPIRY
+            login.first_factored_by! :email_code
+            login.noted! "otp"
+            login.store.delete(HELD)
+
+            actor.verify_email!(token.address)
+          end
+      end
+    end
+  end
+end