masks-server 0.7.0

data/app/models/masks/server/actor.rb

@@ -0,0 +1,523 @@
+module Masks
+  module Server
+    class Actor < ApplicationRecord
+      include TenantScoped
+      include Paged
+
+      MINIMUM_PASSWORD = 8
+      ACTIVITY_GRAIN = 1.day
+
+      IDLE = "idle".freeze
+      MANAGER = "manager".freeze
+      SCIM = "scim".freeze
+      SUSPENSIONS = [ IDLE, MANAGER, SCIM ].freeze
+      EXTERNAL_ID = ->(value) { value.to_s.strip.presence }
+
+      has_secure_password validations: false
+
+      encrypts :otp_secret
+
+      has_many :tokens, dependent: :destroy
+      has_many :sessions, dependent: :destroy
+      has_many :consents, dependent: :destroy
+      has_many :device_factors, dependent: :destroy
+      has_many :passkeys, dependent: :destroy
+      has_many :subjects, dependent: :destroy
+      has_many :delegations, dependent: :destroy
+      has_many :connections, dependent: :destroy
+      has_many :memberships, dependent: :destroy
+      has_many :organizations, -> { merge(Membership.accepted) }, through: :memberships
+      has_many :approvals, class_name: "Client", foreign_key: :approved_by_id, dependent: :nullify
+      has_one :avatar, dependent: :destroy
+      has_many :group_members, dependent: :delete_all
+      has_many :groups, through: :group_members
+
+      before_destroy :sign_out_everywhere!, prepend: true
+
+      validates :nickname,
+                uniqueness: { scope: :tenant_id, case_sensitive: false },
+                format: { with: /\A[a-z0-9][a-z0-9._-]*\z/i },
+                allow_blank: true
+      validates :email,
+                format: { with: URI::MailTo::EMAIL_REGEXP },
+                uniqueness: { scope: :tenant_id, case_sensitive: false },
+                allow_blank: true
+
+      validates :external_id, uniqueness: { scope: :tenant_id }, allow_nil: true
+      validates :suspension_reason, inclusion: { in: SUSPENSIONS }, allow_nil: true
+
+      validates :phone,
+                format: { with: Senders::Sms::NUMBER },
+                uniqueness: { scope: :tenant_id },
+                allow_blank: true
+
+      validate :named
+
+      before_save :activate_once_a_password_exists
+      before_save :forget_code_factors_for_new_addresses
+      after_update :forget_mailed_links, if: :saved_change_to_email?
+
+      normalizes :nickname, with: ->(value) { value.to_s.strip.presence }
+      normalizes :email, with: ->(value) { value.to_s.strip.downcase.presence }
+      normalizes :external_id, with: EXTERNAL_ID
+      normalizes :phone, with: ->(value) { value.to_s.gsub(/[\s().-]/, "").presence }
+
+      normalizes :name, :given_name, :family_name, :middle_name, :profile_url, :picture_url,
+                 :website_url, :gender, :birthdate, :zoneinfo, :locale,
+                 with: ->(value) { value.to_s.strip.presence }
+
+      HOLDING = <<~SQL.squish.freeze
+        EXISTS (
+          SELECT 1 FROM regexp_split_to_table(actors.scopes, '[\\s,]+') AS entry
+          WHERE entry <> ''
+            AND (
+              entry = :held
+              OR (
+                right(entry, 1) = ':'
+                AND starts_with(:held, entry)
+                AND length(:held) > length(entry)
+              )
+            )
+        )
+        OR (btrim(actors.scopes) = '' AND :held = ANY(ARRAY[:standard]))
+      SQL
+
+      scope :directed, -> { where.not(external_id: nil).or(where(id: Membership.where.not(external_id: nil).select(:actor_id))) }
+      scope :holding, ->(held) { where(HOLDING, held: held.to_s.strip, standard: Scopes::STANDARD) }
+
+      class << self
+        def locate(identifier)
+          wanted = identifier.to_s.strip
+          return nil if wanted.blank?
+
+          find_by(nickname: wanted) || find_by(email: wanted.downcase)
+        end
+
+        def authenticate(identifier, password)
+          actor = locate(identifier)
+
+          return burn(password) if actor.nil? || actor.password_digest.blank? || !actor.activated?
+
+          actor.authenticate(password.to_s) || nil
+        end
+
+        def invite!(email:, nickname: nil, scopes: nil)
+          create!(
+            nickname: nickname,
+            email: email,
+            scopes: Scopes.join(Scopes.list(scopes).presence || Scopes::STANDARD)
+          )
+        end
+
+        def decoy_digest
+          @decoy_digest ||= BCrypt::Password.create(SecureRandom.hex(16))
+        end
+
+        private
+
+          def burn(password)
+            BCrypt::Password.new(decoy_digest) == password.to_s
+            nil
+          end
+      end
+
+      def devices
+        Device.for_actor(self)
+      end
+
+      def scope_list
+        list = Scopes.list(scopes)
+
+        list.empty? ? Scopes::STANDARD.dup : list
+      end
+
+      def permitted_scopes(requested)
+        Scopes.union(Scopes.granted(Scopes.list(requested), scope_list), Scopes.delegable(requested),
+                     Scopes.list(requested) & Scopes::EVERYONE)
+      end
+
+      def holds?(scope)
+        scope_list.include?(scope.to_s)
+      end
+
+      def grant!(requested)
+        wanted = Scopes.list(requested) - scope_list
+        return scope_list if wanted.empty?
+
+        update!(scopes: Scopes.join(scope_list + wanted))
+
+        scope_list
+      end
+
+      def withheld(requested)
+        Scopes.list(requested) - permitted_scopes(requested)
+      end
+
+      def identifier
+        nickname.presence || email
+      end
+
+      def handle
+        "@#{nickname}" if nickname.present?
+      end
+
+      def display_name
+        name.presence || handle || email
+      end
+
+      def display_details
+        [ handle, email.presence ].compact - [ display_name ]
+      end
+
+      def email_unconfirmed?
+        email.present? && email_verified_at.nil?
+      end
+
+      def verify_email!(address)
+        return false if email_verified_at.present? || !email.to_s.casecmp?(address.to_s)
+
+        update!(email_verified_at: Time.current)
+        Event.record!(Event::EMAIL_VERIFIED, actor: self)
+
+        true
+      end
+
+      def manages?
+        ManageRoles.any?(scope_list)
+      end
+
+      def owns?
+        holds?(Scopes::MANAGE)
+      end
+
+      def person_json
+        style = Avatars.held?(self) ? Avatars::PHOTO : Avatars::FALLBACK
+
+        {
+          "name" => display_name,
+          "details" => display_details,
+          "note" => (I18n.t("application.person.unconfirmed") if email_unconfirmed?),
+          "role" => (I18n.t("application.person.manager") if manages?),
+          "avatar" => Avatars.url(self, style, subject: uuid, size: 128)
+        }
+      end
+
+      def activated?
+        activated_at.present?
+      end
+
+      def activate!(password, verifying_email: false)
+        self.password = password
+        self.email_verified_at = Time.current if verifying_email && email.present?
+        save!
+      end
+
+      def reset_password!(password, verifying_email: false, keeping: nil)
+        transaction do
+          activate!(password, verifying_email: verifying_email)
+          sign_out_everywhere!(keeping: keeping)
+        end
+      end
+
+      def forget_unproven_ways_in!
+        passkeys.find_each do |passkey|
+          passkey.destroy!
+          Event.record!(Event::PASSKEY_REMOVED, actor: self, passkey: passkey.name)
+        end
+
+        connections.destroy_all
+      end
+
+      def change_password!(current, password, keeping: nil)
+        return false unless activated? && authenticate(current.to_s)
+
+        reset_password!(password, keeping: keeping)
+        true
+      end
+
+      def suspended?
+        suspended_at.present?
+      end
+
+      def suspend!(reason:)
+        return self if suspended?
+
+        transaction do
+          update!(suspended_at: Time.current, suspension_reason: reason, idle_warned_at: nil)
+          sign_out_everywhere!
+          Token.where(actor_id: id).live.update_all(consumed_at: Time.current, updated_at: Time.current)
+        end
+
+        self
+      end
+
+      def directed?
+        Actor.directed.exists?(id)
+      end
+
+      def last_manager?
+        persisted? && owns? && !Actor.holding(Scopes::MANAGE).where(suspended_at: nil).where.not(id: id).exists?
+      end
+
+      def restore!
+        return self unless suspended?
+
+        update!(suspended_at: nil, suspension_reason: nil, idle_warned_at: nil, last_active_at: Time.current)
+        self
+      end
+
+      def active!
+        return if last_active_at && last_active_at > ACTIVITY_GRAIN.ago
+
+        update_columns(last_active_at: Time.current, idle_warned_at: nil)
+      end
+
+      def idle_since
+        last_active_at || last_login_at || activated_at
+      end
+
+      def sign_out_everywhere!(keeping: nil)
+        held = sessions.live
+        held = held.where.not(id: keeping.id) if keeping
+
+        held.find_each(&:revoke!)
+        RefreshToken.where(actor_id: id).live.find_each(&:revoke!)
+        DeviceFactor.forget!(actor: self)
+      end
+
+      def notified?(action)
+        Notifications.mailed?(action) && !muted_notifications.include?(action.to_s)
+      end
+
+      def notifications
+        Notifications::MAILED - muted_notifications
+      end
+
+      def notifications=(wanted)
+        self.muted_notifications = Notifications::MAILED - Array(wanted).map(&:to_s)
+      end
+
+      def otp?
+        otp_enabled_at.present? && otp_secret.present?
+      end
+
+      def verified_passkeys?
+        passkeys.where(user_verified: true).exists?
+      end
+
+      def second_factor?
+        otp? || verified_passkeys?
+      end
+
+      def email_factor?
+        email_factor_at.present? && email.present? && email_verified_at.present?
+      end
+
+      def phone_factor?
+        phone_factor_at.present? && phone.present? && phone_verified_at.present?
+      end
+
+      def password?
+        password_digest.present?
+      end
+
+      def last_way_in?(passkey)
+        !password? && !passkeys.where.not(id: passkey.id).exists? && !connections.live.exists?
+      end
+
+      OTP_DRIFT = 30
+
+      def verify_otp(code)
+        return false unless otp?
+
+        step = otp_step(otp_secret, code)
+
+        step.present? && spend_otp_step(step)
+      end
+
+      def adopt_otp!(secret, code)
+        return false if otp?
+
+        step = otp_step(secret, code)
+
+        return false if step.nil?
+
+        update!(otp_secret: secret, otp_enabled_at: Time.current, otp_last_step: step)
+      end
+
+      BACKUP_CODES = 10
+      BACKUP_CODE_BYTES = 8
+
+      def backup_codes?
+        backup_code_digests.any?
+      end
+
+      def backup_codes_remaining
+        backup_code_digests.length
+      end
+
+      def generate_backup_codes!
+        codes = Array.new(BACKUP_CODES) { SecureRandom.hex(BACKUP_CODE_BYTES) }
+
+        update!(
+          backup_code_digests: codes.map { |code| self.class.digest_backup_code(code) },
+          backup_codes_generated_at: Time.current
+        )
+
+        codes
+      end
+
+      def verify_backup_code(code)
+        return false unless backup_codes?
+
+        digest = self.class.digest_backup_code(code)
+        remaining = backup_code_digests.reject do |held|
+          ActiveSupport::SecurityUtils.secure_compare(held.to_s, digest)
+        end
+
+        return false if remaining.length == backup_code_digests.length
+
+        update!(backup_code_digests: remaining)
+        true
+      end
+
+      def self.digest_backup_code(code)
+        Digest::SHA256.hexdigest(code.to_s.strip.downcase.delete("^a-f0-9"))
+      end
+
+      PROFILE_CLAIMS = {
+        "name" => :name,
+        "given_name" => :given_name,
+        "family_name" => :family_name,
+        "middle_name" => :middle_name,
+        "nickname" => :nickname,
+        "preferred_username" => :nickname,
+        "profile" => :profile_url,
+        "picture" => :picture_url,
+        "website" => :website_url,
+        "gender" => :gender,
+        "birthdate" => :birthdate,
+        "zoneinfo" => :zoneinfo,
+        "locale" => :locale
+      }.freeze
+
+      AVATARS_CLAIM = "masks:avatars".freeze
+      IDENTITIES_CLAIM = "identities".freeze
+      ORGANIZATIONS_CLAIM = "orgs".freeze
+      GROUPS_CLAIM = "groups".freeze
+
+      def claims(scopes, subject:, requested: nil, origin: Current.origin)
+        granted = Scopes.list(scopes)
+        claims = { "sub" => subject, AVATARS_CLAIM => Avatars.urls(self, subject: subject, origin: origin) }
+
+        if granted.include?(Scopes::PROFILE)
+          PROFILE_CLAIMS.each_key { |claim| claims[claim] = claim_value(claim, origin, subject) }
+          claims["updated_at"] = updated_at.to_i
+        end
+
+        if granted.include?(Scopes::EMAIL)
+          claims["email"] = email
+          claims["email_verified"] = email_verified_at.present?
+        end
+
+        claims[IDENTITIES_CLAIM] = identities if granted.include?(Scopes::IDENTITIES) && subject == uuid
+        claims[ORGANIZATIONS_CLAIM] = organizations_held if granted.include?(Scopes::ORGANIZATION)
+        claims[GROUPS_CLAIM] = group_labels if granted.include?(Scopes::GROUPS)
+
+        asked(requested).each do |claim|
+          claims[claim] = claim_value(claim, origin, subject) if PROFILE_CLAIMS.key?(claim)
+        end
+
+        claims.compact
+      end
+
+      def organizations_held
+        memberships.live.map(&:claim)
+      end
+
+      def group_labels
+        @group_labels ||= begin
+          held = groups.pluck(:key)
+          roles = memberships.live.joins(:organization).pluck("organizations.key", :role).map { |key, role| "#{key}:#{role}" }
+
+          (held + roles).uniq.sort
+        end
+      end
+
+      def identities
+        connections.live.includes(:provider).order(:created_at).filter_map do |connection|
+          next if connection.provider.archived?
+
+          {
+            "provider" => connection.provider.key,
+            "protocol" => connection.provider.protocol,
+            "sub" => connection.subject,
+            "email" => (connection.email if connection.email_verified)
+          }.compact
+        end
+      end
+
+      private
+
+        def forget_mailed_links
+          [ PasswordReset, Invitation, EmailVerification ].each do |kind|
+            kind.where(actor_id: id).live.find_each(&:consume!)
+          end
+        end
+
+        def otp_step(secret, code)
+          totp = ROTP::TOTP.new(secret)
+          at = totp.verify(code.to_s.delete("^0-9"), drift_behind: OTP_DRIFT)
+
+          at && at.to_i / totp.interval
+        end
+
+        def spend_otp_step(step)
+          taken = self.class.where(id: id)
+                      .where("otp_last_step IS NULL OR otp_last_step < ?", step)
+                      .update_all(otp_last_step: step)
+
+          return false if taken.zero?
+
+          self.otp_last_step = step
+          true
+        end
+
+        def claim_value(claim, origin, subject)
+          return Avatars.picture(self, subject: subject, origin: origin) if claim == "picture"
+
+          public_send(PROFILE_CLAIMS[claim])
+        end
+
+        def activate_once_a_password_exists
+          self.activated_at ||= Time.current if password_digest.present?
+        end
+
+        def forget_code_factors_for_new_addresses
+          self.email_factor_at = nil if will_save_change_to_email? && !new_record?
+          self.phone_factor_at = nil if will_save_change_to_phone? && !new_record?
+        end
+
+        def named
+          return manages_by_both if manages?
+
+          case tenant&.named_by
+          when Tenant::NICKNAME then errors.add(:nickname, :blank) if nickname.blank?
+          when Tenant::EMAIL then errors.add(:email, :blank) if email.blank?
+          else errors.add(:base, :unnamed) if nickname.blank? && email.blank?
+          end
+        end
+
+        def manages_by_both
+          errors.add(:nickname, :blank) if nickname.blank?
+          errors.add(:email, :blank) if email.blank?
+        end
+
+        def asked(requested)
+          return [] if requested.blank?
+
+          Array(requested["userinfo"]&.keys)
+        end
+    end
+  end
+end

data/app/models/masks/server/addresses.rb

@@ -0,0 +1,65 @@
+module Masks
+  module Server
+    module Addresses
+      HELD = "address_changes".freeze
+
+      CHANNELS = {
+        ConfirmationCode::EMAIL => { verified: :email_verified_at, event: Event::EMAIL_CHANGED },
+        ConfirmationCode::PHONE => { verified: :phone_verified_at, event: Event::PHONE_CHANGED }
+      }.freeze
+
+      class << self
+        def deliverable?(channel)
+          channel == ConfirmationCode::EMAIL ? ActorMailer.deliverable? : Texting.deliverable?
+        end
+
+        def normalize(channel, value)
+          return Senders::Sms.number(value) if channel == ConfirmationCode::PHONE
+
+          email = value.to_s.strip
+          email if email.match?(URI::MailTo::EMAIL_REGEXP)
+        end
+
+        def request!(actor, channel, address, journey:)
+          token, code = ConfirmationCode.open!(actor: actor, channel: channel, address: address)
+
+          Confirmations.deliver(channel, address, code, journey: journey)
+
+          token
+        end
+
+        def pending(session, actor)
+          held = session[HELD]
+          return {} unless held.is_a?(Hash) && held["actor_id"] == actor.id
+
+          CHANNELS.keys.filter_map do |channel|
+            token = held[channel] && ConfirmationCode.find_by(id: held[channel], actor_id: actor.id)
+
+            [ channel, token ] if token&.live? && token.channel == channel
+          end.to_h
+        end
+
+        def hold(session, actor, channel, token)
+          held = session[HELD].is_a?(Hash) && session[HELD]["actor_id"] == actor.id ? session[HELD] : {}
+
+          session[HELD] = held.merge("actor_id" => actor.id, channel => token&.id).compact
+        end
+
+        def confirm!(actor, token, code)
+          return :invalid unless token.verify(code)
+
+          channel = token.channel
+          spec = CHANNELS.fetch(channel)
+          previous = actor.public_send(channel)
+          told = actor.public_send(spec[:verified]).present? ? previous : nil
+
+          return :taken unless actor.update(channel => token.address, spec[:verified] => Time.current)
+
+          Event.record!(spec[:event], actor: actor, previous: told)
+
+          :changed
+        end
+      end
+    end
+  end
+end