masks-server 0.7.0

data/app/logins/masks/server/login_states/passkey.rb

@@ -0,0 +1,113 @@
+module Masks
+  module Server
+    module LoginStates
+      class Passkey < LoginState
+        FIRST_EXPIRY = 12.hours
+        HELD = "passkey_challenge".freeze
+
+        accepts :passkey, :remember
+
+        handles "passkey:challenge" do
+          offer
+        end
+
+        handles "passkey:verify" do
+          verify
+        end
+
+        def enabled?
+          Masks::Server::Passkey.exists?
+        end
+
+        def as_json
+          { "passkey" => { "offered" => offered? }.merge(challenge_json) }
+        end
+
+        def start_over!
+          login.store.delete(HELD)
+        end
+
+        private
+
+          def offered?
+            login.policy.first_factor?(:passkey) || login.first_factored?
+          end
+
+          def challenge_json
+            @options ? { "options" => @options } : {}
+          end
+
+          def offer
+            options = relying_party.authentication_options(login.actor)
+
+            @options = options.as_json
+            login.store[HELD] = { "challenge" => options.challenge }
+          end
+
+          def verify
+            held = login.store[HELD]
+            return warn!("passkey-expired") if held.blank?
+
+            presented = update(:passkey)
+            return warn!("invalid-passkey") if presented.blank?
+
+            settle(held["challenge"], JSON.parse(presented))
+          ensure
+            login.store.delete(HELD)
+          end
+
+          def settle(challenge, response)
+            passkey = Masks::Server::Passkey.find_by(external_id: response["id"])
+            if passkey.nil?
+              refused! "passkey"
+              return warn!("invalid-passkey")
+            end
+
+            credential = relying_party.verify_authentication(response, challenge, passkey)
+            verified = !!credential.response.authenticator_data.user_verified?
+
+            if passkey.cloned?(credential.sign_count)
+              Event.record!(
+                Event::LOGIN_REFUSED,
+                actor: passkey.actor, by: nil, factor: "passkey", cloned: true
+              )
+              return warn!("invalid-passkey")
+            end
+
+            passkey.used!(credential.sign_count, user_verified: verified)
+
+            accept(passkey, verified)
+          rescue WebAuthn::Error, JSON::ParserError
+            refused! "passkey"
+            warn! "invalid-passkey"
+          end
+
+          def accept(passkey, verified)
+            return second(passkey, verified) unless login.policy.first_factor?(:passkey)
+
+            login.identifier = passkey.actor.identifier
+            login.actor = passkey.actor
+
+            factored! :first_factor, expiry: FIRST_EXPIRY
+            login.first_factored_by! :passkey
+            login.noted! "swk"
+
+            second_factored! "user" if verified
+          end
+
+          def second(passkey, verified)
+            unless verified && login.first_factored? && login.actor&.id == passkey.actor_id
+              refused! "passkey"
+              return warn!("factor-not-offered")
+            end
+
+            second_factored! "user"
+          end
+
+          def relying_party
+            RelyingParty.for(tenant, Current.origin)
+          end
+      end
+    end
+  end
+end

data/app/logins/masks/server/login_states/password.rb

@@ -0,0 +1,40 @@
+module Masks
+  module Server
+    module LoginStates
+      class Password < LoginState
+        EXPIRY = 12.hours
+
+        accepts :password
+
+        handles "password", limit: :verifying do
+          verify
+        end
+
+        def as_json
+          { "password" => { "offered" => login.policy.first_factor?(:password) } }
+        end
+
+        def verify
+          return warn!("missing-identifier") if login.identifier.blank?
+          return warn!("factor-not-offered") unless login.policy.first_factor?(:password)
+          return warn!("prove-email-first") if login.state("inbox").pending?
+
+          authenticated = Actor.authenticate(login.identifier, update(:password))
+
+          if authenticated
+            login.actor = authenticated
+            factored! :first_factor, expiry: EXPIRY
+            login.first_factored_by! :password
+            login.noted! "pwd"
+            login.store[RiskCheck::BREACHED] = BreachedPasswords.breached?(update(:password)) if login.policy.refuse_breached_passwords
+          else
+            refused! "password"
+            warn! "invalid-credentials"
+          end
+
+          authenticated.present?
+        end
+      end
+    end
+  end
+end

data/app/logins/masks/server/login_states/password_reset.rb

@@ -0,0 +1,88 @@
+module Masks
+  module Server
+    module LoginStates
+      class PasswordReset < LoginState
+        EXPIRY = 12.hours
+        HELD = "reset".freeze
+        SENT = "reset-sent".freeze
+
+        accepts :password
+
+        handles "forgot-password", limit: :sending do
+          open
+        end
+
+        handles "reset-password" do
+          settle
+        end
+
+        prompts "reset-password" do
+          reset.present?
+        end
+
+        def reload!
+          @loaded = false
+          @reset = nil
+        end
+
+        def as_json
+          held = reset
+          return {} if held.nil?
+
+          {
+            "reset" => {
+              "nickname" => held.actor.identifier,
+              "minimum" => login.policy.password_minimum
+            }
+          }
+        end
+
+        def start_over!
+          login.store.delete(HELD)
+          reload!
+        end
+
+        def reset
+          return @reset if @loaded
+
+          @loaded = true
+          secret = login.store[HELD]
+          @reset = secret.present? ? Masks::Server::PasswordReset.redeem(secret) : nil
+        end
+
+        private
+
+          def open
+            return warn!("missing-identifier") if login.identifier.blank?
+            return warn!("no-mailer") unless ActorMailer.deliverable?
+
+            Recoveries.request(identifier: login.identifier, journey: Masks::Server::Journey.sign_in(login))
+
+            warn! SENT
+          end
+
+          def settle
+            return warn!("reset-expired") if reset.nil?
+            refusal = Passwords.refusal(password, login.policy)
+            return warn!(refusal, field: "password") if refusal
+
+            actor = Masks::Server::PasswordReset.settle!(login.store[HELD], password)
+            return warn!("reset-expired") if actor.nil?
+
+            Event.record!(Event::PASSWORD_RESET_COMPLETED, actor: actor)
+
+            login.store.delete(HELD)
+            reload!
+            login.identifier = actor.identifier
+            login.actor = actor
+            factored! :first_factor, expiry: EXPIRY
+            login.first_factored_by! :password
+          end
+
+          def password
+            update(:password).to_s
+          end
+      end
+    end
+  end
+end

data/app/logins/masks/server/login_states/provider.rb

@@ -0,0 +1,181 @@
+module Masks
+  module Server
+    module LoginStates
+      class Provider < LoginState
+        EXPIRY = 12.hours
+        WINDOW = 15.minutes
+        HELD = "provider_handoff".freeze
+        DISCOVERED = "provider_discovered".freeze
+        CLAIM = "provider_claim".freeze
+
+        accepts :provider, :code, :state, :error, :error_description, :user
+
+        handles "provider" do
+          start
+        end
+
+        handles "provider:callback" do
+          finish
+        end
+
+        def enabled?
+          Masks::Server::Actor.exists? && offered.any?
+        end
+
+        def as_json
+          {
+            "providers" => offered.map { |provider| { "key" => provider.key, "name" => provider.name } }
+          }
+        end
+
+        def start_over!
+          login.store.delete(HELD)
+          login.store.delete(CLAIM)
+          login.store.delete(DISCOVERED)
+        end
+
+        def discover!(provider)
+          return false unless login.policy.first_factor?(:provider)
+
+          login.store[DISCOVERED] = provider.id
+          @offered = nil
+
+          begin!(provider)
+          true
+        end
+
+        def factor!
+          return unless enabled?
+
+          attach!
+
+          super
+        end
+
+        def cleanup!
+          [ HELD, CLAIM ].each do |key|
+            held = login.store[key]
+
+            login.store.delete(key) if held && held["expires_at"].to_i <= Time.current.to_i
+          end
+        end
+
+        private
+
+          def offered
+            @offered ||= if login.policy.first_factor?(:provider)
+              Masks::Server::Provider.signing_in.order(:name).select do |provider|
+                provider.id == login.store[DISCOVERED] ||
+                  (login.policy.offers?(provider) && provider.offered_to?(login.organization || login.named_organization))
+              end
+            else
+              []
+            end
+          end
+
+          def start
+            provider = offered.find { |one| one.key == update(:provider).to_s }
+
+            return warn!("sso-unavailable") if provider.nil?
+
+            begin!(provider)
+          end
+
+          def begin!(provider)
+            location, handoff = provider.federation.start(callback: provider.callback_url)
+
+            login.store[HELD] = handoff.merge(
+              "provider_id" => provider.id,
+              "rid" => login.rid,
+              "expires_at" => WINDOW.from_now.to_i
+            )
+
+            login.redirect_to = location
+          end
+
+          def finish
+            held = login.store.delete(HELD)
+
+            return warn!("sso-expired") if held.blank? || held["expires_at"].to_i <= Time.current.to_i
+
+            provider = offered.find { |one| one.id == held["provider_id"] }
+
+            return warn!("sso-unavailable") if provider.nil? || provider.key != update(:provider).to_s
+
+            identity = provider.federation.finish(login.updates, handoff: held, callback: provider.callback_url)
+            settled = SingleSignOn.resolve!(provider: provider, claims: identity, policy: login.policy)
+
+            signed_in(provider, settled)
+          rescue SingleSignOn::Refused => e
+            refuse(e.warning, provider, e.message)
+          rescue Masks::Server::Provider::Untrusted, Masks::Server::Provider::Refused, Masks::Server::Provider::Unreachable, ArgumentError, OpenSSL::PKey::PKeyError => e
+            refuse("sso-failed", provider, e.message)
+          end
+
+          def signed_in(provider, settled)
+            actor = settled[:actor]
+
+            return claim!(provider, actor, settled[:identity]) if settled[:claiming]
+
+            login.identifier = actor.identifier
+            login.actor = actor
+
+            factored! :first_factor, expiry: EXPIRY
+            login.first_factored_by! :provider, provider: provider
+            login.noted! provider.protocol
+
+            Event.record!(
+              Event::CONNECTION_SIGNED_IN,
+              actor: actor, by: nil, provider: provider.key
+            )
+          end
+
+          def claim!(provider, actor, identity)
+            login.store[CLAIM] = {
+              "provider_id" => provider.id,
+              "actor_id" => actor.id,
+              "identity" => identity.slice("sub", "email", "email_verified", "preferred_username", "name"),
+              "expires_at" => WINDOW.from_now.to_i
+            }
+
+            login.identifier = actor.identifier
+
+            warn! "sso-claiming"
+          end
+
+          def attach!
+            held = login.store[CLAIM]
+
+            return if held.blank?
+            return unless login.actor&.id == held["actor_id"] && login.touched?(:first_factor)
+
+            provider = Masks::Server::Provider.signing_in.find_by(id: held["provider_id"])
+
+            login.store.delete(CLAIM)
+
+            return if provider.nil?
+
+            Connection.record!(
+              provider: provider, actor: login.actor, identity: held["identity"]
+            ).signed_in!
+
+            login.noted! provider.protocol
+
+            Event.record!(
+              Event::CONNECTION_LINKED,
+              actor: login.actor, by: nil, provider: provider.key
+            )
+          end
+
+          def refuse(warning, provider, description)
+            Event.record!(
+              Event::CONNECTION_REFUSED,
+              actor: nil, by: nil, provider: provider.key, reason: description
+            )
+
+            warn! warning
+          end
+      end
+    end
+  end
+end

data/app/logins/masks/server/login_states/risk_check.rb

@@ -0,0 +1,79 @@
+module Masks
+  module Server
+    module LoginStates
+      class RiskCheck < LoginState
+        HELD = "risk".freeze
+        BREACHED = "breached".freeze
+
+        def enabled?
+          actor.present? && touched?(:first_factor) && assessing?
+        end
+
+        def factor!
+          return unless enabled?
+
+          assess! unless assessed?
+
+          refuse_risky! if refusing?
+        end
+
+        def stepping_up?
+          enabled? && assessed? && threshold(:risk_step_up_at)&.then { |at| score >= at }
+        end
+
+        def start_over!
+          login.store.delete(HELD)
+          login.store.delete(BREACHED)
+        end
+
+        private
+
+          def assessing?
+            policy = login.policy
+
+            policy.risk_step_up_at.present? || policy.risk_refuse_at.present?
+          end
+
+          def threshold(name)
+            login.policy.public_send(name)
+          end
+
+          def score
+            login.store.dig(HELD, "score").to_i
+          end
+
+          def stamp
+            login.factored_at(:first_factor)&.iso8601(Login::PRECISION)
+          end
+
+          def assessed?
+            login.store.dig(HELD, "at") == stamp
+          end
+
+          def refusing?
+            (at = threshold(:risk_refuse_at)) && score >= at
+          end
+
+          def assess!
+            risk = Risk.new(actor: actor, device: device, ip_address: Current.ip_address, breached: login.store[BREACHED] == true)
+
+            login.store[HELD] = { "at" => stamp, "score" => risk.score, "signals" => risk.signals }
+
+            return if risk.score.zero?
+
+            Event.record!(Event::SIGN_IN_RISKY, actor: actor, by: nil, score: risk.score, signals: risk.signals,
+                                                refused: refusing?, stepped_up: !refusing? && stepping_up?)
+          end
+
+          def refuse_risky!
+            expire! :first_factor
+
+            Event.record!(Event::LOGIN_REFUSED, actor: actor, by: nil, factor: "risk", score: score)
+
+            warn! "risky-sign-in"
+            prompt! "first-factor"
+          end
+      end
+    end
+  end
+end

data/app/logins/masks/server/login_states/second_factor.rb

@@ -0,0 +1,55 @@
+module Masks
+  module Server
+    module LoginStates
+      class SecondFactor < LoginState
+        def enabled?
+          actor.present? && (actor.second_factor? || codes.enabled?)
+        end
+
+        handles "recovery:request", limit: :sending do
+          request_recovery
+        end
+
+        prompts "second-factor" do
+          login.first_factored? && !login.second_factored?
+        end
+
+        def factor!
+          login.noted! "mfa" if enabled? && remembered?(DeviceFactor::SECOND_FACTOR)
+
+          super
+        end
+
+        def as_json
+          {
+            "secondFactors" => {
+              "otp" => actor.otp?,
+              "passkey" => actor.verified_passkeys?,
+              "trustedDevice" => login.state("trusted-device").offered?
+            },
+            "rememberable" => device.present?,
+            "recovery" => { "requested" => actor.recovery_requested_at.present? },
+            "trustFor" => ActionController::Base.helpers.distance_of_time_in_words(DeviceFactor::LIFETIME)
+          }
+        end
+
+        def start_over!
+          expire! :second_factor
+        end
+
+        private
+
+          def request_recovery
+            return warn!("missing-first-factor") unless login.first_factored? && !login.second_factored?
+
+            HelpRequests.request!(actor, journey: Masks::Server::Journey.sign_in(login))
+            false
+          end
+
+          def codes
+            login.state("code-factor")
+          end
+      end
+    end
+  end
+end