masks-server 0.7.0

data/app/logins/masks/server/login_states/enrolment.rb

@@ -0,0 +1,268 @@
+module Masks
+  module Server
+    module LoginStates
+      class Enrolment < LoginState
+        HELD = "enrolment".freeze
+        OFFERED = "enrolment_offered".freeze
+        WINDOW = 15.minutes
+
+        accepts :code, :passkey, :kept, :factor
+
+        handles "enrol:otp", limit: :verifying do
+          enrol_otp
+        end
+
+        handles "enrol:passkey-challenge" do
+          offer_passkey
+        end
+
+        handles "enrol:passkey", limit: :verifying do
+          enrol_passkey
+        end
+
+        handles "enrol:code-send", limit: :sending do
+          send_code
+        end
+
+        handles "enrol:code", limit: :verifying do
+          enrol_code
+        end
+
+        handles "enrol:done" do
+          finish
+        end
+
+        prompts "enrol" do
+          open! if required? || offered_at_signup?
+          open?
+        end
+
+        def enabled?
+          actor.present? && login.first_factored? && (required? || open? || offered_at_signup?)
+        end
+
+        def as_json
+          {
+            "enrolment" => {
+              "required" => required?,
+              "offers" => offers,
+              "otp" => otp_json,
+              "passkeys" => {
+                "count" => actor.passkeys.count,
+                "verified" => actor.verified_passkeys?,
+                "options" => @passkey_options
+              }.compact,
+              "backupCodes" => {
+                "issued" => held["codes"],
+                "remaining" => actor.backup_codes_remaining
+              }.compact,
+              "codes" => codes_json
+            }
+          }
+        end
+
+        def start_over!
+          login.store.delete(HELD)
+          login.store.delete(OFFERED)
+        end
+
+        def cleanup!
+          stored = login.store[HELD]
+
+          login.store.delete(HELD) if stored.present? && stored["expires_at"].to_i <= Time.current.to_i
+        end
+
+        def required?
+          return false unless login.first_factored? && !actor.second_factor?
+
+          actor.manages? || ((login.policy.second_factor_required || login.stepping_up?) && held_codes.empty?)
+        end
+
+        def offers
+          @offers ||= begin
+            offered = actor.manages? ? SignInPolicy::SECOND_FACTORS : login.policy.second_factors
+
+            { "otp" => offered.include?("otp"), "passkey" => offered.include?("passkey"),
+              "backupCodes" => offered.include?("backup_codes") }.merge(
+                CodeFactors::FACTORS.to_h { |factor| [ factor, offered.include?(factor) && code_offerable?(factor) ] }
+              )
+          end
+        end
+
+        def reload!
+          @offers = nil
+        end
+
+        private
+
+          def held
+            stored = login.store[HELD]
+
+            stored.present? && stored["actor_id"] == actor.id ? stored : {}
+          end
+
+          def open?
+            held.present?
+          end
+
+          def offered_at_signup?
+            login.store[Signup::SIGNED_UP].present? && login.store[OFFERED].blank? && !actor.second_factor? &&
+              held_codes.empty? && offers.except("backupCodes").values.any?
+          end
+
+          def open!
+            return if open?
+
+            login.store[OFFERED] = true
+
+            login.store[HELD] = { "actor_id" => actor.id, "expires_at" => (Time.current + WINDOW).to_i }
+          end
+
+          def hold(**values)
+            login.store[HELD] = held.merge(values.stringify_keys)
+          end
+
+          def otp_json
+            return { "enabled" => true } if actor.otp?
+
+            secret = otp_secret
+            uri = AuthenticatorApp.uri(secret, actor: actor, tenant: tenant)
+
+            {
+              "enabled" => false,
+              "secret" => AuthenticatorApp.grouped(secret),
+              "uri" => uri,
+              "qr" => AuthenticatorApp.qr(uri)
+            }
+          end
+
+          def otp_secret
+            held["otp_secret"] || (open? && hold(otp_secret: ROTP::Base32.random)["otp_secret"]) ||
+              ROTP::Base32.random
+          end
+
+          def enrol_otp
+            return unless open? && !actor.otp? && offers["otp"]
+
+            unless actor.adopt_otp!(otp_secret, update(:code))
+              refused! "enrol_otp"
+              return warn!("invalid-code")
+            end
+
+            Event.record!(Event::AUTHENTICATOR_ENABLED, actor: actor)
+
+            hold(otp_secret: nil)
+            enrolled! "otp", "mfa"
+          end
+
+          def offer_passkey
+            return unless open? && offers["passkey"]
+
+            options = relying_party.registration_options(actor, user_verification: "required")
+
+            @passkey_options = options.as_json
+            hold(passkey: { "challenge" => options.challenge })
+          end
+
+          def enrol_passkey
+            return unless open? && offers["passkey"]
+
+            challenge = held.dig("passkey", "challenge")
+            hold(passkey: nil)
+
+            return warn!("passkey-expired") if challenge.blank?
+            return warn!("passkey-crowded") if Masks::Server::Passkey.crowded?(actor)
+
+            credential = relying_party.verify_registration(JSON.parse(update(:passkey).to_s), challenge)
+
+            unless credential.response.authenticator_data.user_verified?
+              refused! "enrol_passkey"
+              return warn!("passkey-unverified")
+            end
+
+            Masks::Server::Passkey.register!(actor: actor, credential: credential)
+
+            enrolled! "swk", "user", "mfa"
+          rescue WebAuthn::Error, JSON::ParserError, ActiveRecord::RecordInvalid
+            refused! "enrol_passkey"
+            warn! "passkey-unusable"
+          end
+
+          def held_codes
+            CodeFactors::FACTORS.select { |factor| CodeFactors.held?(actor, factor) }
+          end
+
+          def code_offerable?(factor)
+            CodeFactors.address(actor, factor).present? && CodeFactors.deliverable?(factor)
+          end
+
+          def codes_json
+            CodeFactors::FACTORS.select { |factor| offers[factor] }.to_h do |factor|
+              [ factor, { "enabled" => CodeFactors.held?(actor, factor),
+                          "to" => CodeFactors.address(actor, factor),
+                          "sent" => held.dig("code", "factor") == factor || nil }.compact ]
+            end
+          end
+
+          def send_code
+            factor = update(:factor).to_s
+            return unless open? && offers[factor] && !CodeFactors.held?(actor, factor)
+
+            sent = CodeFactors.send!(actor, factor, journey: Masks::Server::Journey.sign_in(login))
+
+            hold(code: { "factor" => factor, "token_id" => sent.id })
+          end
+
+          def enrol_code
+            factor = held.dig("code", "factor")
+            return unless open? && offers[factor]
+
+            token = CodeFactors.sent(actor, factor, held.dig("code", "token_id"))
+            return warn!("confirmation-expired") if token.nil?
+
+            unless token.verify(update(:code))
+              refused! "enrol_#{factor}_code"
+              return warn!("invalid-code")
+            end
+
+            hold(code: nil)
+            CodeFactors.enable!(actor, factor)
+
+            enrolled! CodeFactors.amr(factor), "mfa"
+          end
+
+          def issue_backup_codes
+            return unless offers["backupCodes"] && !actor.backup_codes?
+
+            codes = actor.generate_backup_codes!
+
+            Event.record!(Event::BACKUP_CODES_GENERATED, actor: actor, count: codes.length)
+
+            hold(codes: codes)
+          end
+
+          def enrolled!(*methods)
+            issue_backup_codes
+
+            second_factored!(*methods)
+          end
+
+          def finish
+            return unless open?
+            return warn!("second-factor-required") if required?
+            return warn!("backup-codes-unkept") if held["codes"].present? && !kept?
+
+            login.store.delete(HELD)
+          end
+
+          def kept?
+            ActiveModel::Type::Boolean.new.cast(update(:kept))
+          end
+
+          def relying_party
+            RelyingParty.for(tenant, Current.origin)
+          end
+      end
+    end
+  end
+end

data/app/logins/masks/server/login_states/first_factor.rb

@@ -0,0 +1,17 @@
+module Masks
+  module Server
+    module LoginStates
+      class FirstFactor < LoginState
+        prompts "first-factor" do
+          warn! "organization-sign-in" if login.organization_unsatisfied?
+
+          !login.first_factored?
+        end
+
+        def start_over!
+          expire! :first_factor
+        end
+      end
+    end
+  end
+end

data/app/logins/masks/server/login_states/identifier.rb

@@ -0,0 +1,48 @@
+module Masks
+  module Server
+    module LoginStates
+      class Identifier < LoginState
+        accepts :identifier
+
+        def reload!
+          login.identifier ||= session&.actor&.identifier
+        end
+
+        handles "identify" do
+          login.identifier = update(:identifier)
+
+          warn! "missing-identifier" if login.identifier.blank?
+
+          discover
+        end
+
+        handles "start-over" do
+          login.start_over!
+        end
+
+        prompts "identify" do
+          login.identifier.blank? && !login.first_factored? && !login.first_run?
+        end
+
+        def as_json
+          {
+            "signupOpen" => login.policy.signup && login.policy.local?,
+            "identifies" => login.policy.identifies?
+          }
+        end
+
+        def start_over!
+          login.identifier = nil
+        end
+
+        private
+
+          def discover
+            provider = Masks::Server::DomainClaim.for_email(login.identifier)&.discovers
+
+            login.state("provider").discover!(provider) if provider
+          end
+      end
+    end
+  end
+end

data/app/logins/masks/server/login_states/inbox.rb

@@ -0,0 +1,159 @@
+module Masks
+  module Server
+    module LoginStates
+      class Inbox < LoginState
+        HELD = "inbox".freeze
+
+        accepts :code
+
+        handles "inbox:verify", limit: :verifying do
+          verify
+        end
+
+        handles "inbox:resend", limit: :sending do
+          send_code if resendable?
+        end
+
+        prompts "prove-email" do
+          open!
+          true
+        end
+
+        def enabled?
+          pending?
+        end
+
+        def pending?
+          hiding? && !proven? && !passed?
+        end
+
+        def proven?(identifier = login.identifier)
+          address = self.class.address(identifier)
+
+          address.present? && held["proven"] == address
+        end
+
+        def as_json
+          {
+            "inbox" => {
+              "email" => address,
+              "mails" => ActorMailer.deliverable?,
+              "resendable" => resendable?
+            }
+          }
+        end
+
+        def start_over!
+          login.store.delete(HELD)
+        end
+
+        def cleanup!
+          proven = login.store.dig(HELD, "proven")
+          owner = login.actor
+
+          return if proven.blank? || owner.nil? || !login.first_factored?
+
+          owner.verify_email!(proven)
+        end
+
+        def self.address(identifier)
+          held = identifier.to_s.strip.downcase
+
+          held.include?("@") ? held : nil
+        end
+
+        private
+
+          def hiding?
+            login.policy.hidden && !login.first_run? && address.present?
+          end
+
+          def passed?
+            located = named
+
+            located.present? &&
+              ((login.first_factored? && login.actor&.id == located.id) ||
+               session&.actor&.id == located.id ||
+               (device.present? && DeviceFactor.live.exists?(device: device, actor: located)))
+          end
+
+          def named
+            return @named[address] if @named&.key?(address)
+
+            (@named ||= {})[address] = Masks::Server::Actor.locate(address)
+          end
+
+          def address
+            self.class.address(login.identifier)
+          end
+
+          def held
+            stored = login.store[HELD]
+
+            stored.present? && stored["address"] == address ? stored : {}
+          end
+
+          def token
+            return @token if defined?(@token)
+
+            id = held["token_id"]
+            found = id && Masks::Server::ConfirmationCode.inbox.find_by(id: id)
+
+            @token = found&.live? && found.address == address ? found : nil
+          end
+
+          def resendable?
+            token&.resendable? != false
+          end
+
+          def open!
+            return unless ActorMailer.deliverable?
+            return if token || held["sent"].present?
+
+            send_code
+          end
+
+          def send_code
+            remove_instance_variable(:@token) if defined?(@token)
+
+            if Masks::Server::ConfirmationCode.inbox_crowded?(address: address, ip: Current.ip_address)
+              login.store[HELD] = { "address" => address, "sent" => Time.current.to_i }
+              return warn!("too-many-codes")
+            end
+
+            opened, code = Masks::Server::ConfirmationCode.open_inbox!(address: address, ip: Current.ip_address)
+
+            ActorMailer.confirmation_code(address, code, journey: Masks::Server::Journey.sign_in(login)).deliver_later
+
+            login.store[HELD] = { "address" => address, "token_id" => opened.id, "sent" => Time.current.to_i }
+          end
+
+          def verify
+            return unless hiding?
+            return warn!("confirmation-expired") if token.nil?
+
+            unless token.verify(update(:code)) && token.address == address
+              remove_instance_variable(:@token)
+              refused! "inbox"
+              return warn!("invalid-code")
+            end
+
+            login.store[HELD] = { "address" => address, "proven" => address }
+
+            settle
+          end
+
+          def settle
+            reveal_absence if named.nil? && !login.state("signup").enabled?
+          end
+
+          def reveal_absence
+            login.identifier = nil
+            login.store.delete(HELD)
+
+            warn! "no-account-for-email"
+          end
+      end
+    end
+  end
+end

data/app/logins/masks/server/login_states/invitation.rb

@@ -0,0 +1,80 @@
+module Masks
+  module Server
+    module LoginStates
+      class Invitation < LoginState
+        EXPIRY = 12.hours
+        HELD = "invitation".freeze
+
+        accepts :password
+
+        handles "accept-invitation" do
+          accept
+        end
+
+        prompts "accept-invitation" do
+          invitation.present?
+        end
+
+        def reload!
+          @loaded = false
+          @invitation = nil
+        end
+
+        def enabled?
+          invitation.present?
+        end
+
+        def as_json
+          held = invitation
+          return {} if held.nil?
+
+          {
+            "invitation" => {
+              "nickname" => held.actor.identifier,
+              "email" => held.actor.email,
+              "invitedBy" => held.opened_by&.identifier,
+              "minimum" => login.policy.password_minimum
+            }
+          }
+        end
+
+        def start_over!
+          login.store.delete(HELD)
+          reload!
+        end
+
+        def invitation
+          return @invitation if @loaded
+
+          @loaded = true
+          secret = login.store[HELD]
+          @invitation = secret.present? ? Masks::Server::Invitation.redeem(secret) : nil
+        end
+
+        private
+
+          def accept
+            return warn!("invitation-expired") if invitation.nil?
+            refusal = Passwords.refusal(password, login.policy)
+            return warn!(refusal, field: "password") if refusal
+
+            actor = Masks::Server::Invitation.accept!(login.store[HELD], password)
+            return warn!("invitation-expired") if actor.nil?
+
+            Event.record!(Event::INVITATION_ACCEPTED, actor: actor)
+
+            login.store.delete(HELD)
+            reload!
+            login.identifier = actor.identifier
+            login.actor = actor
+            factored! :first_factor, expiry: EXPIRY
+            login.first_factored_by! :password
+          end
+
+          def password
+            update(:password).to_s
+          end
+      end
+    end
+  end
+end

data/app/logins/masks/server/login_states/one_time_password.rb

@@ -0,0 +1,30 @@
+module Masks
+  module Server
+    module LoginStates
+      class OneTimePassword < LoginState
+        accepts :code, :remember
+
+        def enabled?
+          actor&.otp?
+        end
+
+        handles "otp", limit: :verifying do
+          verify
+        end
+
+        def verify
+          return warn!("missing-first-factor") unless login.first_factored?
+
+          if actor.verify_otp(update(:code))
+            second_factored! "otp"
+            true
+          else
+            refused! "otp"
+            warn! "invalid-code"
+            false
+          end
+        end
+      end
+    end
+  end
+end

data/app/logins/masks/server/login_states/organization_choice.rb

@@ -0,0 +1,108 @@
+module Masks
+  module Server
+    module LoginStates
+      class OrganizationChoice < LoginState
+        FACTOR = "organization".freeze
+        EXPIRY = 1.hour
+
+        accepts :organization
+
+        def enabled?
+          request.present? && actor.present? && login.first_factored? && wanted?
+        end
+
+        handles "organization" do
+          choose!(update(:organization))
+        end
+
+        prompts "choose-organization" do
+          selected.nil?
+        end
+
+        def factor!
+          if enabled?
+            settle_without_asking!
+
+            super
+          end
+
+          hold_to_policy!
+        end
+
+        def as_json
+          return {} if selected
+
+          {
+            "organizations" => memberships.map do |membership|
+              { "key" => membership.organization.key, "name" => membership.organization.name, "role" => membership.role }
+            end
+          }
+        end
+
+        def selected
+          return nil unless enabled?
+
+          key = chosen_key
+
+          key && memberships.find { |membership| membership.organization.key == key }&.organization
+        end
+
+        def chosen_key
+          held = login.store.dig("factors", FACTOR)
+
+          held["key"] if held.is_a?(Hash) && held["rid"] == login.rid.to_s && touched?(FACTOR)
+        end
+
+        def start_over!
+          expire! FACTOR
+        end
+
+        def reload!
+          @memberships = nil
+        end
+
+        private
+
+          def wanted?
+            request.organization_key.present? || request.scopes_for(actor).include?(Scopes::ORGANIZATION)
+          end
+
+          def memberships
+            @memberships ||= actor.memberships.live.to_a
+          end
+
+          def hold_to_policy!
+            return if login.organization.nil?
+
+            if login.organization_refuses?
+              refuse!("access_denied", "#{login.organization.name} does not admit this account's address")
+            end
+
+            return unless login.organization_unsatisfied?
+
+            warn! "organization-sign-in"
+            prompt! "first-factor"
+          end
+
+          def settle_without_asking!
+            return if selected
+
+            named = request.organization_key
+
+            return choose!(named) if named
+            return refuse!("access_denied", "#{actor.identifier} belongs to no organization") if memberships.empty?
+
+            choose!(memberships.first.organization.key) if memberships.one?
+          end
+
+          def choose!(key)
+            membership = memberships.find { |held| held.organization.key == key.to_s }
+
+            refuse!("access_denied", "#{actor.identifier} is not a member of #{key}") if membership.nil?
+
+            factored!(FACTOR, expiry: EXPIRY).merge!("rid" => login.rid.to_s, "key" => membership.organization.key)
+          end
+      end
+    end
+  end
+end