masks-server 0.7.0

data/app/logins/masks/server/login_states/signup.rb

@@ -0,0 +1,351 @@
+module Masks
+  module Server
+    module LoginStates
+      class Signup < LoginState
+        EXPIRY = 12.hours
+        WINDOW = 30.minutes
+        HELD = "signup".freeze
+        WORK = "signup_work".freeze
+        SIGNED_UP = "signed_up".freeze
+        FIRST_RUN_STEPS = %w[identification credentials configuration].freeze
+        STEPS = %w[identification credentials].freeze
+
+        accepts :nickname, :email, :name, :phone, :password, :password_confirmation, :token, :passkey,
+                :work, :work_counter
+
+        class << self
+          def steps(first_run, policy = nil)
+            return FIRST_RUN_STEPS if first_run
+
+            confirming = policy && (policy.confirmation != SignInPolicy::NONE || policy.email_verified || policy.phone_verified)
+
+            confirming ? STEPS + [ "confirmation" ] : STEPS
+          end
+        end
+
+        handles "signup", limit: :verifying do
+          hold
+          claim
+        end
+
+        handles "signup-edit" do
+          edit
+        end
+
+        handles "signup:passkey-challenge" do
+          offer_passkey
+        end
+
+        handles "signup:passkey", limit: :verifying do
+          claim_with_passkey
+        end
+
+        prompts "signup" do
+          held.blank? || held["editing"]
+        end
+
+        prompts "signup-credentials" do
+          true
+        end
+
+        def enabled?
+          return false if login.first_factored?
+
+          login.first_run? || open_to?(login.identifier)
+        end
+
+        def as_json
+          policy = login.policy
+
+          {
+            "signup" => {
+              "token" => login.first_run? && !held["vouched"],
+              "minimum" => policy.password_minimum,
+              "asks" => { "nickname" => policy.nickname, "email" => policy.email, "phone" => policy.phone },
+              "fixed" => proven_email ? [ "email" ] : [],
+              "credentials" => { "password" => policy.first_factor?(:password), "passkey" => policy.passkey_signup? },
+              "nickname" => held.fetch("nickname") { suggested("nickname") },
+              "email" => proven_email || held.fetch("email") { suggested("email") },
+              "name" => held["name"],
+              "phone" => held["phone"],
+              "passkeyOptions" => @passkey_options,
+              "work" => work_challenge
+            }.compact
+          }
+        end
+
+        def start_over!
+          login.store.delete(HELD)
+          login.store.delete(WORK)
+        end
+
+        def cleanup!
+          return if held.blank?
+
+          login.store.delete(HELD) if held["expires_at"].to_i <= Time.current.to_i
+        end
+
+        private
+
+          def held
+            login.store[HELD] || {}
+          end
+
+          def open_to?(identifier)
+            policy = login.policy
+
+            return false unless policy.signup && policy.local?
+            return false if identifier.blank? || located?(identifier)
+            return false if policy.hidden && !login.state("inbox").proven?(identifier)
+
+            !identifier.include?("@") || policy.admits?(identifier)
+          end
+
+          def proven_email
+            return nil unless login.policy.hidden && login.state("inbox").proven?
+
+            Inbox.address(login.identifier)
+          end
+
+          def located?(identifier)
+            @located ||= {}
+            @located.fetch(identifier) { @located[identifier] = Masks::Server::Actor.locate(identifier).present? }
+          end
+
+          def suggested(field)
+            return nil if login.identifier.blank?
+
+            (field == "email") == login.identifier.include?("@") ? login.identifier : nil
+          end
+
+          def hold
+            return if held.present? && !held["editing"] && !identifying?
+            return unless permitted?
+
+            values = %w[nickname email name phone].to_h do |field|
+              [ field, Masks::Server::Actor.normalize_value_for(field.to_sym, update(field)) ]
+            end
+
+            values["email"] = proven_email if proven_email
+
+            return unless described?(values) && worked?
+
+            login.store[HELD] = values.merge("vouched" => login.first_run?, "worked" => true,
+                                              "expires_at" => (Time.current + WINDOW).to_i)
+          end
+
+          def proving_work?
+            !login.first_run? && login.policy.proves_work? && !held["worked"]
+          end
+
+          def work_challenge
+            return nil unless proving_work?
+
+            ProofOfWork.issue(bits: login.policy.proof_of_work, bound_to: work_binding)
+          end
+
+          def worked?
+            return true unless proving_work?
+
+            solved = ProofOfWork.verify(update(:work), update(:work_counter),
+                                        bits: login.policy.proof_of_work, bound_to: work_binding)
+
+            return true if solved
+
+            refused! "signup_work" if update(:work).present?
+            warn! "work-unsolved"
+            false
+          end
+
+          def work_binding
+            login.store[WORK] ||= SecureRandom.hex(16)
+          end
+
+          def described?(values)
+            policy = login.policy
+
+            kept do
+              %w[nickname email phone].each do |field|
+                warn! "missing-#{field}", field: field if policy.requires?(field) && values[field].blank?
+              end
+
+              warn! "missing-identifier" if values["nickname"].blank? && values["email"].blank?
+              warn! "invalid-phone", field: "phone" if values["phone"].present? && Senders::Sms.number(values["phone"]).nil?
+              warn! "signup-domain-refused", field: "email" if values["email"].present? && !policy.admits?(values["email"])
+            end
+          end
+
+          def edit
+            return if held.blank?
+
+            login.store[HELD] = held.merge("editing" => true)
+          end
+
+          def claim
+            return if held.blank? || held["editing"] || !crediting?
+            return warn!("factor-not-offered") unless login.policy.first_factor?(:password)
+
+            refusal = Passwords.refusal(password, login.policy)
+
+            credited = kept do
+              warn! refusal, field: "password" if refusal
+              warn! "mismatched-password", field: "password_confirmation" if password != update(:password_confirmation).to_s
+            end
+
+            return unless credited
+
+            actor = create(password: password)
+
+            return if actor.nil?
+
+            settle(actor, :password)
+            login.noted! "pwd"
+          end
+
+          def offer_passkey
+            return if held.blank? || held["editing"]
+            return warn!("factor-not-offered") unless login.policy.passkey_signup?
+
+            handle = held["webauthn_id"] || WebAuthn.generate_user_id
+            options = relying_party.registration_options(
+              Masks::Server::Actor.new(held.slice("nickname", "email", "name").merge("webauthn_id" => handle)),
+              user_verification: "required", resident_key: "required"
+            )
+
+            @passkey_options = options.as_json
+            login.store[HELD] = held.merge("webauthn_id" => handle, "passkey_challenge" => options.challenge)
+          end
+
+          def claim_with_passkey
+            return if held.blank? || held["editing"]
+            return warn!("factor-not-offered") unless login.policy.passkey_signup?
+
+            challenge = held["passkey_challenge"]
+            login.store[HELD] = held.except("passkey_challenge")
+
+            return warn!("passkey-expired") if challenge.blank?
+
+            credential = relying_party.verify_registration(JSON.parse(update(:passkey).to_s), challenge)
+
+            unless credential.response.authenticator_data.user_verified?
+              refused! "signup_passkey"
+              return warn!("passkey-unverified")
+            end
+
+            actor = create(webauthn_id: held["webauthn_id"]) do |created|
+              Masks::Server::Passkey.register!(actor: created, credential: credential)
+            end
+
+            return if actor.nil?
+
+            settle(actor, :passkey)
+            factored! :second_factor, expiry: EXPIRY
+            login.noted! "swk", "user", "mfa"
+          rescue WebAuthn::Error, JSON::ParserError
+            refused! "signup_passkey"
+            warn! "passkey-unusable"
+          end
+
+          def settle(actor, factor)
+            Event.record!(Event::ACCOUNT_CREATED, actor: actor, first_run: @first_run,
+                                                  signup: !@first_run, policy: login.policy.key)
+
+            Verifications.open(actor: actor, journey: Masks::Server::Journey.sign_in(login)) unless !@first_run && login.policy.confirmation == SignInPolicy::CODE
+            Confirmations.request_approval(actor, journey: Masks::Server::Journey.sign_in(login)) if actor.pending_approval_at.present?
+
+            login.store.delete(HELD)
+            login.identifier = actor.identifier
+            login.actor = actor
+            login.first_run!
+            factored! :first_factor, expiry: EXPIRY
+            login.first_factored_by! factor
+            login.store[SIGNED_UP] = { "first_run" => @first_run, "expires_at" => (Time.current + EXPIRY).to_i }
+            login.store[Configure::HELD] = true if @first_run
+            tenant.set_up! if @first_run
+          end
+
+          def create(password: nil, webauthn_id: nil)
+            proven = proven_email
+
+            Masks::Server::Actor.transaction do
+              Masks::Server::Tenant.where(id: tenant.id).lock.pick(:id)
+
+              @first_run = !Masks::Server::Actor.exists?
+              login.first_run! unless @first_run
+
+              unless @first_run || open_to?(held["email"] || held["nickname"])
+                warn! "invalid-account"
+                raise ActiveRecord::Rollback
+              end
+
+              now = Time.current
+              actor = Masks::Server::Actor.new(
+                nickname: held["nickname"],
+                email: held["email"],
+                name: held["name"],
+                phone: held["phone"],
+                password: password,
+                webauthn_id: webauthn_id,
+                activated_at: password ? nil : now,
+                email_verified_at: proven.present? && held["email"] == proven ? now : nil,
+                signed_up_at: now,
+                pending_approval_at: !@first_run && login.policy.confirmation == SignInPolicy::APPROVAL ? now : nil,
+                scopes: Scopes.join(@first_run ? Scopes::STANDARD + [ Scopes::MANAGE ] : login.policy.signup_scope_list)
+              )
+
+              unless actor.save
+                warn! "invalid-account"
+                raise ActiveRecord::Rollback
+              end
+
+              begin
+                yield actor if block_given?
+              rescue ActiveRecord::RecordInvalid
+                warn! "passkey-unusable"
+                raise ActiveRecord::Rollback
+              end
+
+              actor
+            end
+          end
+
+          def relying_party
+            RelyingParty.for(tenant, Current.origin)
+          end
+
+          def kept
+            before = login.warnings.size
+
+            yield
+
+            login.warnings.size == before
+          end
+
+          def identifying?
+            %w[nickname email name phone].any? { |field| updates.key?(field) }
+          end
+
+          def crediting?
+            updates.key?("password") || updates.key?("password_confirmation")
+          end
+
+          def permitted?
+            return true unless login.first_run?
+            return true if held["vouched"]
+
+            given = update(:token).to_s
+
+            return true if given.present? &&
+                           ActiveSupport::SecurityUtils.secure_compare(given, tenant.setup_token!)
+
+            warn! "invalid-setup-token", field: "token"
+            false
+          end
+
+          def password
+            update(:password).to_s
+          end
+      end
+    end
+  end
+end

data/app/logins/masks/server/login_states/suspension.rb

@@ -0,0 +1,18 @@
+module Masks
+  module Server
+    module LoginStates
+      class Suspension < LoginState
+        def enabled?
+          actor.present? && login.first_factored?
+        end
+
+        def factor!
+          return unless enabled? && actor.suspended?
+
+          refused!("suspended")
+          refuse!("access_denied", "this account is suspended")
+        end
+      end
+    end
+  end
+end

data/app/logins/masks/server/login_states/trusted_device.rb

@@ -0,0 +1,84 @@
+module Masks
+  module Server
+    module LoginStates
+      class TrustedDevice < LoginState
+        HELD = "trusted_device".freeze
+
+        accepts :remember
+
+        handles "approval:request", limit: :sending do
+          request_approval
+        end
+
+        handles "approval:check" do
+          check
+        end
+
+        def enabled?
+          actor.present? && offered? && login.first_factored? && !login.second_factored?
+        end
+
+        def offered?
+          return @offered if defined?(@offered)
+
+          @offered = login.policy.second_factor?("trusted_device") &&
+                     SignInApproval.approvers?(actor: actor, except: device)
+        end
+
+        def as_json
+          { "approval" => approval_json }.compact
+        end
+
+        def start_over!
+          login.store.delete(HELD)
+        end
+
+        private
+
+          def held
+            stored = login.store[HELD]
+
+            stored.present? && stored["actor_id"] == actor.id ? stored : {}
+          end
+
+          def approval
+            return @approval if defined?(@approval)
+
+            id = held["token_id"]
+            @approval = id && SignInApproval.find_by(id: id, actor_id: actor.id, device_id: device&.id)
+          end
+
+          def approval_json
+            return nil if approval.nil?
+
+            state =
+              if approval.denied? then "denied"
+              elsif approval.live? then "waiting"
+              else "expired"
+              end
+
+            { "code" => held["code"].to_s.scan(/.{1,3}/).join(" "), "state" => state }
+          end
+
+          def request_approval
+            return warn!("missing-first-factor") unless login.first_factored?
+            return if approval&.live? && !approval.answered? && !approval.resendable?
+
+            opened, code = SignInApproval.open!(actor: actor, device: device)
+
+            remove_instance_variable(:@approval) if defined?(@approval)
+            login.store[HELD] = { "actor_id" => actor.id, "token_id" => opened.id, "code" => code }
+          end
+
+          def check
+            return if approval.nil?
+            return warn!("approval-denied") if approval.denied?
+            return unless approval.approved? && approval.claim!
+
+            login.store.delete(HELD)
+            second_factored!
+          end
+      end
+    end
+  end
+end

data/app/mailers/masks/server/actor_mailer.rb

@@ -0,0 +1,184 @@
+module Masks
+  module Server
+    class ActorMailer < ApplicationMailer
+      def invitation(actor, url, journey:, membership: nil)
+        return message unless deliverable?
+
+        journey!(journey)
+        @actor = actor
+        @url = url
+        @organization = membership&.organization
+        @lede = membership ? organization_lede(membership) : tenant_lede(journey.manager)
+
+        mail(
+          from: self.class.from,
+          to: actor.email,
+          subject: customize!(
+            :invitation, actor: actor, organization: @organization&.name,
+            default: membership ? organization_subject(membership) : t("actor_mailer.invitation.subject", tenant: @tenant_name)
+          )
+        )
+      end
+
+      def organization_invitation(membership, journey:)
+        return message unless deliverable?
+
+        journey!(journey)
+        @actor = membership.actor
+        @organization = membership.organization
+        @role = membership.role
+        @lede = organization_lede(membership)
+        @url = home && "#{home}#organization-#{@organization.key}"
+
+        subject = customize!(:organization_invitation, actor: @actor, organization: @organization.name, role: @role,
+                                                       default: organization_subject(membership))
+
+        mail(from: self.class.from, to: @actor.email, subject: subject)
+      end
+
+      def password_reset(actor, url, journey:)
+        return message unless deliverable?
+
+        journey!(journey)
+        @actor = actor
+        @url = url
+        @opened_by = journey.manager
+
+        mail(
+          from: self.class.from,
+          to: actor.email,
+          subject: customize!(:password_reset, actor: actor, default: t("actor_mailer.password_reset.subject", tenant: @tenant_name))
+        )
+      end
+
+      def notification(actor, event, journey:, to: actor.email)
+        return message unless deliverable?
+
+        journey!(journey)
+        told = Notifications.told(event, @tenant_name)
+
+        @actor = actor
+        @event = event
+        @said = t("actor_mailer.notification.said.#{event.action}", **told, default: Notifications.said(event))
+        @wrong = t("actor_mailer.notification.wrong_for.#{event.action}", **told, default: t("actor_mailer.notification.wrong"))
+        @where = Notifications.where(event)
+        @at = Notifications.at(event, actor)
+        @by = event.by if event.by && event.by_id != actor.id
+        @url = home
+        @settings = home && "#{home}#notifications"
+
+        mail(
+          from: self.class.from,
+          to: to,
+          subject: t("actor_mailer.notification.subject", said: Notifications.said(event), tenant: @tenant_name)
+        )
+      end
+
+      def email_verification(actor, url, journey:)
+        return message unless deliverable?
+
+        journey!(journey)
+        @actor = actor
+        @url = url
+
+        mail(
+          from: self.class.from,
+          to: actor.email,
+          subject: customize!(:email_verification, actor: actor, default: t("actor_mailer.email_verification.subject", tenant: @tenant_name))
+        )
+      end
+
+      def confirmation_code(email, code, journey:)
+        return message unless deliverable?
+
+        journey!(journey)
+        @code = code
+
+        mail(
+          from: self.class.from,
+          to: email,
+          subject: customize!(:confirmation_code, code: code, default: t("actor_mailer.confirmation_code.subject", code: code, tenant: @heading))
+        )
+      end
+
+      def approval_requested(manager, actor, journey:)
+        return message unless deliverable?
+
+        journey!(journey)
+        @actor = actor
+        @url = journey.origin.presence && "#{journey.origin}/manage/actors/#{actor.uuid}"
+
+        mail(
+          from: self.class.from,
+          to: manager.email,
+          subject: customize!(:approval_requested, nickname: actor.identifier, default: t("actor_mailer.approval_requested.subject", nickname: actor.identifier, tenant: @tenant_name))
+        )
+      end
+
+      def recovery_requested(manager, actor, journey:)
+        return message unless deliverable?
+
+        journey!(journey)
+        @actor = actor
+        @url = journey.origin.presence && "#{journey.origin}/manage/actors/#{actor.uuid}"
+
+        mail(
+          from: self.class.from,
+          to: manager.email,
+          subject: customize!(:recovery_requested, nickname: actor.identifier, default: t("actor_mailer.recovery_requested.subject", nickname: actor.identifier, tenant: @tenant_name))
+        )
+      end
+
+      def idle(actor, due:, notice:, journey:)
+        return message unless deliverable?
+
+        journey!(journey)
+        @actor = actor
+        @due = I18n.l(due.to_date, format: :long)
+        @notice = notice
+        @keeps = notice != IdleAccounts::DELETE_SUSPENDED
+        @url = @keeps && home
+
+        mail(
+          from: self.class.from,
+          to: actor.email,
+          subject: t("actor_mailer.idle.subject.#{@keeps ? 'active' : 'suspended'}", tenant: @tenant_name)
+        )
+      end
+
+      def approved(actor, journey:)
+        return message unless deliverable?
+
+        journey!(journey)
+        @actor = actor
+        @url = home
+
+        mail(
+          from: self.class.from,
+          to: actor.email,
+          subject: customize!(:approved, actor: actor, default: t("actor_mailer.approved.subject", tenant: @tenant_name))
+        )
+      end
+
+      private
+
+        def tenant_lede(manager)
+          return t("actor_mailer.invitation.invited", tenant: @tenant_name) if manager.nil?
+
+          t("actor_mailer.invitation.invited_by", nickname: manager.identifier, tenant: @tenant_name)
+        end
+
+        def organization_lede(membership)
+          named = { organization: membership.organization.name, role: membership.role }
+
+          return t("actor_mailer.organization_invitation.invited", **named) if membership.invited_by.nil?
+
+          t("actor_mailer.organization_invitation.invited_by", nickname: membership.invited_by.identifier, **named)
+        end
+
+        def organization_subject(membership)
+          t("actor_mailer.organization_invitation.subject", organization: membership.organization.name)
+        end
+    end
+  end
+end

data/app/mailers/masks/server/application_mailer.rb

@@ -0,0 +1,66 @@
+module Masks
+  module Server
+    class ApplicationMailer < ActionMailer::Base
+      layout "masks/server/mailer"
+      helper ApplicationHelper
+
+      self.delivery_job = MailDeliveryJob
+
+      class << self
+        def from
+          Current.tenant&.mail_from || ::Rails.configuration.masks.mail_from
+        end
+
+        def deliverable?
+          return true if Current.previewing
+          return Current.tenant.mails? if Current.tenant
+
+          from.present?
+        end
+      end
+
+      def mail(headers = {}, &block)
+        super.tap do |message|
+          sender = Current.tenant&.mail_sender
+
+          if sender
+            message.delivery_method(*sender.delivery_method)
+          elsif Server.config.smtp_settings && delivery_method != :test
+            message.delivery_method(:smtp, Server.config.smtp_settings)
+          end
+        end
+      end
+
+      private
+
+        def deliverable?
+          self.class.deliverable?
+        end
+
+        def journey!(journey)
+          @journey = journey
+          @tenant_name = journey.tenant_name
+          @heading = journey.heading
+          @signature = templates[MailTemplate::SIGNATURE]&.paragraphs_for(tenant: @tenant_name)
+        end
+
+        def customize!(kind, default:, actor: nil, **values)
+          held = templates[kind.to_s]
+          return default if held.nil?
+
+          values = { tenant: @tenant_name, name: actor&.display_name, nickname: actor&.identifier }.merge(values)
+          @message = held.paragraphs_for(values)
+
+          held.subject_for(values) || default
+        end
+
+        def templates
+          @templates ||= Current.tenant ? MailTemplate.all.index_by(&:kind) : {}
+        end
+
+        def home
+          @journey.origin.presence && "#{@journey.origin}/"
+        end
+    end
+  end
+end