masks-server 0.7.0

data/app/mailers/masks/server/sender_mailer.rb

@@ -0,0 +1,13 @@
+module Masks
+  module Server
+    class SenderMailer < ApplicationMailer
+      def trial(to, sender:, journey:)
+        journey!(journey)
+
+        mail(from: sender.from, to: to, subject: t("sender_mailer.test.subject", tenant: @tenant_name)).tap do |message|
+          message.delivery_method(*sender.delivery_method)
+        end
+      end
+    end
+  end
+end

data/app/models/concerns/masks/server/archivable.rb

@@ -0,0 +1,22 @@
+module Masks
+  module Server
+    module Archivable
+      extend ActiveSupport::Concern
+
+      included do
+        scope :active, -> { where(archived_at: nil) }
+        scope :archived, -> { where.not(archived_at: nil) }
+      end
+
+      class_methods do
+        def listed(archived)
+          archived ? self.archived : active
+        end
+      end
+
+      def archived?
+        archived_at.present?
+      end
+    end
+  end
+end

data/app/models/concerns/masks/server/carries_authorization.rb

@@ -0,0 +1,75 @@
+module Masks
+  module Server
+    module CarriesAuthorization
+      extend ActiveSupport::Concern
+
+      class_methods do
+        def attributes_for(authorization)
+          {
+            client: authorization.client,
+            scopes: Scopes.join(authorization.requested_scopes),
+            audience: authorization.audience,
+            redirect_uri: authorization.redirect_uri,
+            nonce: authorization.nonce,
+            code_challenge: authorization.code_challenge,
+            code_challenge_method: authorization.code_challenge_method,
+            requested_claims: authorization.requested_claims,
+            authorization_details: authorization.authorization_details&.as_json,
+            jkt: authorization.dpop_jkt,
+            payload: {
+              "response_type" => authorization.response_type,
+              "state" => authorization.state,
+              "prompt" => authorization.prompt,
+              "max_age" => authorization.max_age,
+              "acr_values" => authorization.acr_values.presence,
+              "organization" => authorization.organization,
+              "user_code" => authorization.user_code,
+              "signed" => (true if authorization.signed?),
+              "saml" => authorization.saml
+            }.compact
+          }
+        end
+      end
+
+      def authorization
+        @authorization ||= Authorization.new(
+          client_id: client&.client_id,
+          redirect_uri: redirect_uri,
+          response_type: held("response_type"),
+          scope: scopes,
+          state: held("state"),
+          nonce: nonce,
+          code_challenge: code_challenge,
+          code_challenge_method: code_challenge_method,
+          prompt: Scopes.join(Array(held("prompt"))),
+          max_age: held("max_age"),
+          acr_values: Scopes.join(Array(held("acr_values"))),
+          organization: held("organization"),
+          resource: audience,
+          claims: requested_claims,
+          authorization_details: authorization_details,
+          user_code: held("user_code"),
+          dpop_jkt: jkt,
+          signed: held("signed") == true,
+          saml: held("saml")
+        )
+      end
+
+      def device?
+        authorization.device?
+      end
+
+      def organization_key
+        authorization.organization
+      end
+
+      def saml?
+        authorization.saml?
+      end
+
+      def scopes_for(actor)
+        authorization.scopes_for(actor)
+      end
+    end
+  end
+end

data/app/models/concerns/masks/server/mailed_link.rb

@@ -0,0 +1,47 @@
+module Masks
+  module Server
+    module MailedLink
+      extend ActiveSupport::Concern
+
+      class_methods do
+        def path(segment = nil)
+          @path = segment if segment
+
+          @path
+        end
+
+        def open!(actor:, by: nil, **held)
+          where(actor_id: actor.id).live.find_each(&:consume!)
+
+          mint!(actor: actor, payload: { "email" => actor.email }.merge(held.stringify_keys, { "by" => by&.uuid }.compact))
+        end
+      end
+
+      def address
+        (payload || {})["email"]
+      end
+
+      def addressed?
+        address.present? && actor.email.present? && actor.email == address
+      end
+
+      def opened_by
+        uuid = (payload || {})["by"]
+
+        @opened_by ||= uuid && Actor.find_by(uuid: uuid)
+      end
+
+      def url(origin)
+        "#{origin}/#{self.class.path}/#{secret}"
+      end
+
+      def delivered!
+        update!(payload: (payload || {}).merge("delivered" => true))
+      end
+
+      def delivered?
+        (payload || {})["delivered"].present?
+      end
+    end
+  end
+end

data/app/models/concerns/masks/server/paged.rb

@@ -0,0 +1,18 @@
+module Masks
+  module Server
+    module Paged
+      extend ActiveSupport::Concern
+
+      included do
+        scope :newest_first, -> { order(created_at: :desc, id: :desc) }
+        scope :after, ->(id) {
+          held = klass.where(id: id).pick(:created_at, :id)
+
+          next none if held.nil?
+
+          where("(#{klass.quoted_table_name}.created_at, #{klass.quoted_table_name}.id) < (?, ?)", *held)
+        }
+      end
+    end
+  end
+end

data/app/models/concerns/masks/server/tenant_scoped.rb

@@ -0,0 +1,13 @@
+module Masks
+  module Server
+    module TenantScoped
+      extend ActiveSupport::Concern
+
+      included do
+        belongs_to :tenant, default: -> { Current.tenant }
+
+        default_scope { where(tenant_id: Current.tenant&.id) }
+      end
+    end
+  end
+end

data/app/models/masks/server/access_token.rb

@@ -0,0 +1,69 @@
+module Masks
+  module Server
+    class AccessToken < Token
+      TYPE = "at+jwt".freeze
+
+      def self.lifetime
+        1.hour
+      end
+
+      def self.decode(secret, issuer:, verify_expiration: true, required: %w[iss exp jti])
+        issuer.verify(secret, typ: TYPE, required: required, verify_expiration: verify_expiration)
+      end
+
+      def self.issue!(issuer:, actor:, client:, scopes:, audience:, parent: nil, expires_at: nil, act: nil, requested_claims: nil,
+                      jkt: nil, authorization_details: nil)
+        ceiling = [ expires_at, (client&.access_lifetime || lifetime).from_now ].compact.min
+
+        token = create!(
+          actor: actor,
+          client: client,
+          device: parent&.device,
+          session: parent&.session,
+          organization: parent&.organization,
+          parent: parent,
+          scopes: Scopes.join(scopes),
+          audience: Array(audience),
+          requested_claims: requested_claims,
+          authorization_details: authorization_details.presence,
+          digest: SecureRandom.uuid,
+          jkt: jkt,
+          expires_at: ceiling
+        )
+
+        token.instance_variable_set(:@jwt, issuer.sign(token.claims(issuer, act: act), typ: TYPE))
+        token
+      end
+
+      def jti
+        digest
+      end
+
+      def jwt
+        @jwt
+      end
+
+      def claims(issuer, act: nil)
+        {
+          "iss" => issuer.url,
+          "sub" => subject(issuer),
+          "aud" => audience.one? ? audience.first : audience,
+          "exp" => expires_at.to_i,
+          "iat" => created_at.to_i,
+          "jti" => jti,
+          "client_id" => client&.client_id,
+          "scope" => Scopes.join(scopes),
+          "authorization_details" => authorization_details.presence,
+          "act" => act,
+          Organization::CLAIM => organization_claim,
+          "cnf" => confirmation,
+          "tenant" => tenant.to_identity
+        }.compact
+      end
+
+      def token_type
+        bound? ? Proof::SCHEME : "Bearer"
+      end
+    end
+  end
+end

data/app/models/masks/server/account_export.rb

@@ -0,0 +1,144 @@
+module Masks
+  module Server
+    class AccountExport
+      PROFILE = %i[
+        nickname name given_name middle_name family_name email phone profile_url picture_url website_url
+        gender birthdate zoneinfo locale
+      ].freeze
+      MOMENTS = %i[
+        created_at signed_up_at activated_at email_verified_at phone_verified_at last_login_at last_active_at
+        suspended_at
+      ].freeze
+
+      attr_reader :actor, :tenant
+
+      def initialize(actor, tenant: Current.tenant)
+        @actor = actor
+        @tenant = tenant
+      end
+
+      def filename
+        "#{tenant.subdomain}-#{actor.identifier.to_s.parameterize.presence || 'account'}-#{Date.current.iso8601}.json"
+      end
+
+      def to_json(*)
+        JSON.pretty_generate(as_json)
+      end
+
+      def as_json(*)
+        {
+          "exported_at" => moment(Time.current),
+          "tenant" => tenant.subdomain,
+          "account" => account,
+          "factors" => factors,
+          "passkeys" => passkeys,
+          "organizations" => organizations,
+          "connections" => connections,
+          "apps" => apps,
+          "devices" => devices,
+          "events" => events
+        }
+      end
+
+      private
+
+        def moment(value)
+          value&.utc&.iso8601
+        end
+
+        def account
+          PROFILE.to_h { |field| [ field.to_s, actor.public_send(field) ] }
+                 .merge(MOMENTS.to_h { |field| [ field.to_s, moment(actor.public_send(field)) ] })
+                 .merge("uuid" => actor.uuid, "suspension_reason" => actor.suspension_reason)
+                 .compact
+        end
+
+        def factors
+          {
+            "password" => actor.password_digest.present?,
+            "authenticator_app" => moment(actor.otp_enabled_at),
+            "backup_codes" => moment(actor.backup_codes_generated_at),
+            "email_codes" => moment(actor.email_factor_at),
+            "text_message_codes" => moment(actor.phone_factor_at)
+          }.compact
+        end
+
+        def passkeys
+          Passkey.where(actor: actor).includes(:authenticator).order(:created_at).map do |passkey|
+            {
+              "name" => passkey.label,
+              "created_at" => moment(passkey.created_at),
+              "last_used_at" => moment(passkey.last_used_at)
+            }.compact
+          end
+        end
+
+        def organizations
+          actor.memberships.includes(:organization).order(:created_at).map do |membership|
+            {
+              "organization" => membership.organization.name,
+              "key" => membership.organization.key,
+              "role" => membership.role,
+              "pending" => membership.pending,
+              "joined_at" => moment(membership.created_at)
+            }
+          end
+        end
+
+        def connections
+          Connection.where(actor: actor).includes(:provider, delegations: :client).order(:created_at).map do |connection|
+            {
+              "provider" => connection.provider.name,
+              "subject" => connection.subject,
+              "email" => connection.email,
+              "connected_at" => moment(connection.connected_at || connection.created_at),
+              "signed_in_at" => moment(connection.signed_in_at),
+              "revoked_at" => moment(connection.revoked_at),
+              "delegations" => connection.delegations.map do |delegation|
+                {
+                  "app" => delegation.client.name,
+                  "scopes" => Scopes.list(delegation.scopes),
+                  "consented_at" => moment(delegation.consented_at),
+                  "revoked_at" => moment(delegation.revoked_at)
+                }.compact
+              end
+            }.compact
+          end
+        end
+
+        def apps
+          Consent.where(actor: actor).includes(:client).order(:created_at).map do |consent|
+            {
+              "app" => consent.client.name,
+              "client_id" => consent.client.client_id,
+              "scopes" => Scopes.list(consent.scopes),
+              "granted_at" => moment(consent.created_at),
+              "revoked_at" => moment(consent.revoked_at)
+            }.compact
+          end
+        end
+
+        def devices
+          trusted = DeviceFactor.live.where(actor: actor).pluck(:device_id).to_set
+
+          actor.devices.map do |device|
+            {
+              "name" => device.name,
+              "user_agent" => device.user_agent,
+              "ip_address" => device.ip_address,
+              "first_seen_at" => moment(device.created_at),
+              "last_seen_at" => moment(device.last_seen_at),
+              "trusted" => trusted.include?(device.id),
+              "blocked_at" => moment(device.blocked_at)
+            }.compact
+          end
+        end
+
+        def events
+          Event.where(actor: actor)
+               .includes(:actor, :by, :client, :organization).order(:created_at, :id)
+               .map { |event| event.exported(tenant).except(:tenant, :id) }
+        end
+    end
+  end
+end