masks-server 0.7.0

data/app/models/masks/server/app_preset.rb

@@ -0,0 +1,251 @@
+module Masks
+  module Server
+    class AppPreset
+      class Unusable < StandardError; end
+
+      NAME = /\A[A-Za-z0-9_-]{1,64}\z/
+
+      ALL = [
+        {
+          key: "proxy", name: "Any app behind Caddy, Traefik, or nginx", forward: true,
+          redirects: [ "{base}/masks-auth/callback" ],
+          scopes: %w[openid],
+          guide: "https://masks.pages.dev/guides/forward-auth/",
+          settings: [
+            [ "Caddy", "{host} {\n  forward_auth {masks_origin} {\n    uri /forward-auth\n    header_up Host {masks_host}\n" \
+                       "    copy_headers Remote-User Remote-Email Remote-Name Remote-Groups\n  }\n  reverse_proxy your-app:8080\n}" ],
+            [ "Traefik", "http:\n  middlewares:\n    masks:\n      forwardAuth:\n        address: {forward_auth}\n" \
+                         "        authResponseHeaders: [Remote-User, Remote-Email, Remote-Name, Remote-Groups]" ],
+            [ "nginx", "location = /masks-check {\n  internal;\n  proxy_pass {forward_auth}?status=401;\n" \
+                       "  proxy_pass_request_body off;\n  proxy_set_header Content-Length \"\";\n" \
+                       "  proxy_set_header X-Original-URL $scheme://$http_host$request_uri;\n  proxy_ssl_server_name on;\n}\n" \
+                       "location /masks-auth/ {\n  proxy_pass {masks_origin}/forward-auth/;\n" \
+                       "  proxy_set_header X-Forwarded-Host $host;\n  proxy_set_header X-Forwarded-Proto $scheme;\n" \
+                       "  proxy_ssl_server_name on;\n}\n" \
+                       "location / {\n  auth_request /masks-check;\n  auth_request_set $remote_user $upstream_http_remote_user;\n" \
+                       "  proxy_set_header Remote-User $remote_user;\n" \
+                       "  error_page 401 =302 {masks_origin}/forward-auth/start?rd=$scheme://$http_host$request_uri;\n" \
+                       "  proxy_pass http://your-app:8080;\n}" ]
+          ]
+        },
+        {
+          key: "grafana", name: "Grafana",
+          redirects: [ "{base}/login/generic_oauth" ],
+          scopes: %w[openid profile email groups offline_access],
+          guide: "https://grafana.com/docs/grafana/latest/setup-grafana/configure-access/configure-authentication/generic-oauth/",
+          settings: [
+            [ "[auth.generic_oauth] enabled", "true" ],
+            [ "client_id", "{client_id}" ], [ "client_secret", "{client_secret}" ],
+            [ "scopes", "openid profile email groups offline_access" ],
+            [ "auth_url", "{authorize}" ], [ "token_url", "{token}" ], [ "api_url", "{userinfo}" ],
+            [ "role_attribute_path", "contains(groups[*], 'admins') && 'Admin' || 'Viewer'" ]
+          ]
+        },
+        {
+          key: "nextcloud", name: "Nextcloud",
+          redirects: [ "{base}/apps/user_oidc/code", "{base}/index.php/apps/user_oidc/code" ],
+          scopes: %w[openid profile email groups],
+          guide: "https://github.com/nextcloud/user_oidc",
+          settings: [
+            [ "occ user_oidc:provider", "masks --clientid={client_id} --clientsecret={client_secret} " \
+                                        "--discoveryuri={discovery} --group-provisioning=1" ]
+          ]
+        },
+        {
+          key: "gitea", name: "Gitea", asks: { "name" => "masks" },
+          redirects: [ "{base}/user/oauth2/{name}/callback" ],
+          scopes: %w[openid profile email groups],
+          guide: "https://docs.gitea.com/administration/authentication/",
+          settings: [
+            [ "gitea admin auth add-oauth", "--name {name} --provider openidConnect --key {client_id} " \
+                                            "--secret {client_secret} --auto-discover-url {discovery} " \
+                                            "--scopes \"email profile groups\" --group-claim-name groups --admin-group admins" ]
+          ]
+        },
+        {
+          key: "forgejo", name: "Forgejo", asks: { "name" => "masks" },
+          redirects: [ "{base}/user/oauth2/{name}/callback" ],
+          scopes: %w[openid profile email groups],
+          guide: "https://forgejo.org/docs/latest/admin/advanced/oidc-group-mappings/",
+          settings: [
+            [ "forgejo admin auth add-oauth", "--name {name} --provider openidConnect --key {client_id} " \
+                                              "--secret {client_secret} --auto-discover-url {discovery} " \
+                                              "--scopes \"email profile groups\" --group-claim-name groups" ]
+          ]
+        },
+        {
+          key: "immich", name: "Immich",
+          redirects: [ "app.immich:///oauth-callback", "{base}/auth/login", "{base}/user-settings" ],
+          scopes: %w[openid profile email],
+          guide: "https://docs.immich.app/administration/oauth/",
+          settings: [
+            [ "Issuer URL", "{issuer}" ], [ "Client ID", "{client_id}" ], [ "Client Secret", "{client_secret}" ],
+            [ "Scope", "openid email profile" ], [ "Token Endpoint Auth Method", "client_secret_post" ]
+          ]
+        },
+        {
+          key: "outline", name: "Outline",
+          redirects: [ "{base}/auth/oidc.callback" ],
+          scopes: %w[openid profile email offline_access],
+          guide: "https://docs.getoutline.com/s/hosting/doc/oidc-8CPBm6uC0I",
+          settings: [
+            [ "OIDC_ISSUER_URL", "{issuer}" ], [ "OIDC_CLIENT_ID", "{client_id}" ],
+            [ "OIDC_CLIENT_SECRET", "{client_secret}" ], [ "OIDC_SCOPES", "openid profile email offline_access" ],
+            [ "OIDC_DISPLAY_NAME", "{tenant}" ]
+          ]
+        },
+        {
+          key: "audiobookshelf", name: "Audiobookshelf",
+          redirects: [ "{base}/auth/openid/callback", "{base}/auth/openid/mobile-redirect" ],
+          scopes: %w[openid profile email],
+          guide: "https://www.audiobookshelf.org/guides/oidc_authentication/",
+          settings: [
+            [ "Issuer URL", "{issuer}" ], [ "Client ID", "{client_id}" ], [ "Client Secret", "{client_secret}" ]
+          ]
+        },
+        {
+          key: "paperless", name: "Paperless-ngx", asks: { "name" => "masks" },
+          redirects: [ "{base}/accounts/oidc/{name}/login/callback/" ],
+          scopes: %w[openid profile email groups],
+          guide: "https://docs.paperless-ngx.com/advanced_usage/",
+          settings: [
+            [ "PAPERLESS_APPS", "allauth.socialaccount.providers.openid_connect" ],
+            [ "PAPERLESS_SOCIALACCOUNT_PROVIDERS",
+              "{\"openid_connect\":{\"SCOPE\":[\"openid\",\"profile\",\"email\",\"groups\"],\"APPS\":[{\"provider_id\":\"{name}\"," \
+              "\"name\":\"{tenant}\",\"client_id\":\"{client_id}\",\"secret\":\"{client_secret}\"," \
+              "\"settings\":{\"server_url\":\"{discovery}\"}}]}}" ],
+            [ "PAPERLESS_SOCIAL_ACCOUNT_SYNC_GROUPS", "true" ]
+          ]
+        },
+        {
+          key: "portainer", name: "Portainer",
+          redirects: [ "{base}", "{base}/" ],
+          scopes: %w[openid profile email],
+          guide: "https://docs.portainer.io/admin/settings/authentication/oauth",
+          settings: [
+            [ "Client ID", "{client_id}" ], [ "Client secret", "{client_secret}" ],
+            [ "Authorization URL", "{authorize}" ], [ "Access token URL", "{token}" ], [ "Resource URL", "{userinfo}" ],
+            [ "Redirect URL", "{base}" ], [ "Logout URL", "{logout}" ], [ "User identifier", "preferred_username" ],
+            [ "Scopes", "openid profile email" ]
+          ]
+        },
+        {
+          key: "proxmox", name: "Proxmox VE", asks: { "name" => "masks" },
+          redirects: [ "{base}" ],
+          scopes: %w[openid profile email groups],
+          guide: "https://pve.proxmox.com/wiki/User_Management",
+          settings: [
+            [ "pveum realm add", "{name} --type openid --issuer-url {issuer} --client-id {client_id} " \
+                                 "--client-key {client_secret} --username-claim username --autocreate 1 " \
+                                 "--scopes \"email profile groups\" --groups-claim groups" ]
+          ]
+        },
+        {
+          key: "jellyfin", name: "Jellyfin (SSO plugin)", asks: { "name" => "masks" },
+          redirects: [ "{base}/sso/OID/redirect/{name}", "{base}/sso/OID/r/{name}" ],
+          scopes: %w[openid profile groups],
+          guide: "https://github.com/9p4/jellyfin-plugin-sso",
+          settings: [
+            [ "OID Endpoint", "{issuer}" ], [ "OID Client ID", "{client_id}" ], [ "OID Secret", "{client_secret}" ],
+            [ "Request Additional Scopes", "groups" ], [ "Role Claim", "groups" ], [ "Admin Roles", "admins" ]
+          ]
+        },
+        {
+          key: "vaultwarden", name: "Vaultwarden",
+          redirects: [ "{base}/identity/connect/oidc-signin" ],
+          scopes: %w[openid profile email],
+          guide: "https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect",
+          settings: [
+            [ "SSO_ENABLED", "true" ], [ "SSO_AUTHORITY", "{issuer}" ],
+            [ "SSO_CLIENT_ID", "{client_id}" ], [ "SSO_CLIENT_SECRET", "{client_secret}" ]
+          ]
+        },
+        {
+          key: "mealie", name: "Mealie",
+          redirects: [ "{base}/login", "{base}/login?direct=1" ],
+          scopes: %w[openid profile email groups],
+          guide: "https://mealie.io/documentation/getting-started/authentication/oidc-v2/",
+          settings: [
+            [ "OIDC_AUTH_ENABLED", "true" ], [ "OIDC_CONFIGURATION_URL", "{discovery}" ],
+            [ "OIDC_CLIENT_ID", "{client_id}" ], [ "OIDC_CLIENT_SECRET", "{client_secret}" ],
+            [ "OIDC_ADMIN_GROUP", "admins" ], [ "OIDC_PROVIDER_NAME", "{tenant}" ]
+          ]
+        },
+        {
+          key: "open-webui", name: "Open WebUI",
+          redirects: [ "{base}/oauth/oidc/callback" ],
+          scopes: %w[openid profile email groups],
+          guide: "https://docs.openwebui.com/features/authentication-access/auth/sso/",
+          settings: [
+            [ "OPENID_PROVIDER_URL", "{discovery}" ], [ "OAUTH_CLIENT_ID", "{client_id}" ],
+            [ "OAUTH_CLIENT_SECRET", "{client_secret}" ], [ "OAUTH_SCOPES", "openid email profile groups" ],
+            [ "OAUTH_PROVIDER_NAME", "{tenant}" ], [ "ENABLE_OAUTH_SIGNUP", "true" ],
+            [ "ENABLE_OAUTH_ROLE_MANAGEMENT", "true" ], [ "OAUTH_ROLES_CLAIM", "groups" ], [ "OAUTH_ADMIN_ROLES", "admins" ]
+          ]
+        }
+      ].map(&:freeze).freeze
+
+      class << self
+        def all
+          ALL.map { |definition| new(definition) }
+        end
+
+        def find(key)
+          definition = ALL.find { |held| held[:key] == key.to_s }
+
+          definition && new(definition)
+        end
+      end
+
+      attr_reader :definition
+
+      def initialize(definition)
+        @definition = definition
+      end
+
+      def key = definition[:key]
+      def name = definition[:name]
+      def asks = definition.fetch(:asks, {})
+      def scopes = definition[:scopes]
+      def guide = definition[:guide]
+      def forward? = definition.fetch(:forward, false)
+
+      def redirect_uris(base:, name: nil)
+        definition[:redirects].map { |template| fill(template, values(base: base, name: name)) }.uniq
+      end
+
+      def settings(base:, issuer:, client:, secret:, name: nil)
+        known = values(base: base, name: name).merge(
+          "issuer" => issuer.url, "discovery" => "#{issuer.url}/.well-known/openid-configuration",
+          "authorize" => issuer.discovery["authorization_endpoint"], "token" => issuer.discovery["token_endpoint"],
+          "userinfo" => issuer.discovery["userinfo_endpoint"], "logout" => issuer.discovery["end_session_endpoint"],
+          "client_id" => client.client_id, "client_secret" => secret.to_s, "tenant" => issuer.tenant.name,
+          "forward_auth" => "#{issuer.url}/forward-auth", "masks_origin" => Forwarded.origin(issuer.url).to_s,
+          "masks_host" => URI.parse(issuer.url).host, "host" => URI.parse(known_base(base)).host
+        )
+
+        definition[:settings].map { |label, template| { "label" => label, "value" => fill(template, known) } }
+      end
+
+      private
+
+        def known_base(base)
+          base.to_s.strip.delete_suffix("/")
+        end
+
+        def values(base:, name:)
+          trimmed = base.to_s.strip.delete_suffix("/")
+          named = name.presence || asks["name"]
+
+          raise Unusable, "the address must start with http:// or https://" unless trimmed.match?(%r{\Ahttps?://[^/\s]+})
+          raise Unusable, "the name may hold letters, digits, dashes, and underscores" if asks.key?("name") && !named.to_s.match?(NAME)
+
+          { "base" => trimmed, "name" => named }
+        end
+
+        def fill(template, known)
+          template.gsub(/\{([a-z_]+)\}/) { known.fetch(Regexp.last_match(1)) { Regexp.last_match(0) } }
+        end
+    end
+  end
+end

data/app/models/masks/server/application_record.rb

@@ -0,0 +1,17 @@
+module Masks
+  module Server
+    class ApplicationRecord < ActiveRecord::Base
+      self.abstract_class = true
+
+      connects_to database: { writing: Server.config.database, reading: Server.config.database } if Server.config.database
+
+      def self.model_name
+        @_model_name ||= ActiveModel::Name.new(self, nil, name.delete_prefix("Masks::Server::"))
+      end
+
+      def self.encrypts(*names, **options)
+        super(*names, **options.reverse_merge(key_provider: Server.key_provider))
+      end
+    end
+  end
+end

data/app/models/masks/server/apps.rb

@@ -0,0 +1,56 @@
+module Masks
+  module Server
+    module Apps
+      Held = Data.define(:client, :scopes, :consent) do
+        def name
+          client.name
+        end
+
+        def client_id
+          client.client_id
+        end
+
+        def scope_list
+          Scopes.list(scopes)
+        end
+
+        def audience
+          consent&.audience || []
+        end
+      end
+
+      def self.held_by(actor)
+        consents = Consent.live.where(actor: actor).includes(:client).index_by(&:client_id)
+        scopes = token_scopes(actor)
+
+        ids = (consents.keys + scopes.keys).uniq
+        clients = Client.where(id: ids).index_by(&:id)
+
+        ids.filter_map do |id|
+          client = clients[id]
+          next if client.nil?
+
+          consent = consents[id]
+          held = consent ? Scopes.list(consent.scopes) | scopes.fetch(id, []) : scopes.fetch(id, [])
+
+          Held.new(client: client, scopes: Scopes.join(held), consent: consent)
+        end.sort_by { |app| app.name.to_s.downcase }
+      end
+
+      def self.launchable(actor)
+        Client.active.approved.includes(:logo)
+              .where("clients.client_uri IS NOT NULL OR clients.saml_idp_initiated")
+              .order(:name).select { |client| client.admits?(actor) }
+      end
+
+      def self.token_scopes(actor)
+        Token.live.where(actor: actor, kind: [ AccessToken.sti_name, RefreshToken.sti_name ])
+             .where.not(client_id: nil)
+             .pluck(:client_id, :scopes)
+             .each_with_object({}) do |(client_id, scopes), held|
+          held[client_id] = (held[client_id] || []) | Scopes.list(scopes)
+        end
+      end
+    end
+  end
+end

data/app/models/masks/server/authenticator.rb

@@ -0,0 +1,57 @@
+module Masks
+  module Server
+    class Authenticator < ApplicationRecord
+      MDS = "mds".freeze
+      BUNDLED = "bundled".freeze
+
+      COMPROMISED = %w[
+        ATTESTATION_KEY_COMPROMISE
+        USER_VERIFICATION_BYPASS
+        USER_KEY_REMOTE_COMPROMISE
+        USER_KEY_PHYSICAL_COMPROMISE
+        REVOKED
+      ].freeze
+
+      CERTIFIED = %w[
+        FIDO_CERTIFIED FIDO_CERTIFIED_L1 FIDO_CERTIFIED_L1plus
+        FIDO_CERTIFIED_L2 FIDO_CERTIFIED_L2plus
+        FIDO_CERTIFIED_L3 FIDO_CERTIFIED_L3plus
+      ].freeze
+
+      validates :aaguid, :name, :source, presence: true
+      validates :aaguid, uniqueness: true
+
+      scope :compromised, -> { where.not(compromised_at: nil) }
+
+      def self.describing(aaguid)
+        return nil if aaguid.blank?
+
+        find_by(aaguid: aaguid)
+      end
+
+      def self.compromise_in(statuses)
+        Array(statuses).find { |status| COMPROMISED.include?(status.to_s) }
+      end
+
+      def self.certification_in(statuses)
+        Array(statuses).reverse.find { |status| CERTIFIED.include?(status.to_s) }
+      end
+
+      def compromised?
+        compromised_at.present?
+      end
+
+      def certified?
+        certification.present?
+      end
+
+      def compromise
+        self.class.compromise_in(statuses)
+      end
+
+      def authoritative?
+        source == MDS
+      end
+    end
+  end
+end

data/app/models/masks/server/authenticator_app.rb

@@ -0,0 +1,51 @@
+module Masks
+  module Server
+    module AuthenticatorApp
+      GROUP = 4
+      HELD = "authenticator_setup".freeze
+
+      class << self
+        def offered?(actor, policy: SignInPolicy.for(tenant: Current.tenant))
+          actor.manages? || policy.second_factor?("otp")
+        end
+
+        def backup_codes_offered?(actor, policy: SignInPolicy.for(tenant: Current.tenant))
+          actor.manages? || policy.second_factor?("backup_codes")
+        end
+
+        def setup_secret(session, actor)
+          held = session[HELD]
+
+          return held["secret"] if held.is_a?(Hash) && held["actor_id"] == actor.id
+
+          session[HELD] = { "actor_id" => actor.id, "secret" => ROTP::Base32.random }
+          session[HELD]["secret"]
+        end
+
+        def grouped(secret)
+          secret.scan(/.{1,#{GROUP}}/).join(" ")
+        end
+
+        def uri(secret, actor:, tenant: Current.tenant)
+          ROTP::TOTP.new(secret, issuer: tenant&.name.presence || "masks").provisioning_uri(actor.identifier)
+        end
+
+        def qr(uri)
+          RQRCode::QRCode.new(uri).as_svg(
+            module_size: 4, use_path: true, viewbox: true, standalone: true,
+            color: "000", fill: "fff", offset: 16,
+            svg_attributes: { "aria-hidden": "true" }
+          ).sub(/\A<\?xml[^>]*>/, "")
+        end
+
+        def remove!(actor)
+          attributes = { otp_secret: nil, otp_enabled_at: nil }
+          attributes.merge!(backup_code_digests: [], backup_codes_generated_at: nil) unless actor.verified_passkeys?
+
+          actor.update!(attributes)
+          DeviceFactor.forget!(actor: actor)
+        end
+      end
+    end
+  end
+end

data/app/models/masks/server/authenticators.rb

@@ -0,0 +1,78 @@
+module Masks
+  module Server
+    module Authenticators
+      class Unreachable < StandardError; end
+
+      BUNDLED = Engine.root.join("db/authenticators.yml")
+
+      def self.refresh!(store: FidoMetadata::Store.new, out: nil)
+        counted = { mds: 0, bundled: 0, compromised: 0 }
+
+        each_entry(store) do |entry|
+          held = record(entry)
+          next if held.nil?
+
+          counted[:mds] += 1
+          counted[:compromised] += 1 if held.compromised?
+        end
+
+        counted[:bundled] = fill_gaps
+        out&.puts(summary(counted))
+        counted
+      end
+
+      def self.each_entry(store)
+        store.table_of_contents.entries.each { |entry| yield entry }
+      rescue StandardError => e
+        raise Unreachable, "the metadata service could not be read: #{e.class}: #{e.message}"
+      end
+
+      def self.record(entry)
+        aaguid = entry.aaguid.presence
+        return nil if aaguid.nil?
+
+        statuses = Array(entry.status_reports).map { |report| report.status.to_s }.reject(&:blank?)
+        statement = entry.metadata_statement
+
+        upsert(
+          aaguid: aaguid,
+          name: statement&.description.presence || aaguid,
+          source: Authenticator::MDS,
+          icon: statement&.icon,
+          certification: Authenticator.certification_in(statuses),
+          statuses: statuses,
+          compromised_at: Authenticator.compromise_in(statuses) ? Time.current : nil
+        )
+      end
+
+      def self.fill_gaps
+        return 0 unless BUNDLED.exist?
+
+        known = Authenticator.where(source: Authenticator::MDS).pluck(:aaguid).to_set
+
+        YAML.safe_load_file(BUNDLED).reject { |aaguid, _| known.include?(aaguid) }.count do |aaguid, name|
+          upsert(aaguid: aaguid, name: name, source: Authenticator::BUNDLED, statuses: [])
+        end
+      end
+
+      def self.upsert(aaguid:, name:, source:, statuses:, icon: nil, certification: nil, compromised_at: nil)
+        held = Authenticator.find_or_initialize_by(aaguid: aaguid)
+
+        return held if held.persisted? && held.authoritative? && source == Authenticator::BUNDLED
+
+        held.update!(
+          name: name, source: source, icon: icon,
+          certification: certification, statuses: statuses,
+          compromised_at: compromised_at
+        )
+
+        held
+      end
+
+      def self.summary(counted)
+        "#{counted[:mds]} from the metadata service, #{counted[:bundled]} bundled, " \
+          "#{counted[:compromised]} with a reported compromise"
+      end
+    end
+  end
+end