masks-server 0.7.0

data/app/models/masks/server/authorization.rb

@@ -0,0 +1,200 @@
+module Masks
+  module Server
+    class Authorization
+      attr_reader :client_id, :redirect_uri, :response_type, :state, :nonce,
+                  :code_challenge, :code_challenge_method, :prompt, :audience,
+                  :requested_scopes, :max_age, :acr_values, :organization, :requested_claims, :request_uri,
+                  :user_code, :dpop_jkt, :request_object, :saml
+
+      def self.from_request(request)
+        repeated = Rack::Utils.parse_query(request.query_string)
+        repeated = repeated.merge(Rack::Utils.parse_query(request.raw_post)) { |_, a, b| Array(a) + Array(b) } if request.post?
+        params = request.params
+
+        new(
+          client_id: params["client_id"],
+          redirect_uri: params["redirect_uri"],
+          response_type: params["response_type"],
+          scope: params["scope"],
+          state: params["state"],
+          nonce: params["nonce"],
+          code_challenge: params["code_challenge"],
+          code_challenge_method: params["code_challenge_method"],
+          prompt: params["prompt"],
+          max_age: params["max_age"],
+          acr_values: params["acr_values"],
+          organization: params["organization"],
+          resource: repeated["resource"],
+          request: params["request"],
+          request_uri: params["request_uri"],
+          claims: params["claims"],
+          authorization_details: params["authorization_details"],
+          dpop_jkt: params["dpop_jkt"]
+        )
+      end
+
+      def initialize(client_id:, redirect_uri:, response_type:, scope: nil, state: nil,
+                     nonce: nil, code_challenge: nil, code_challenge_method: nil,
+                     prompt: nil, max_age: nil, acr_values: nil, organization: nil, resource: nil, request: nil,
+                     request_uri: nil, claims: nil, authorization_details: nil, user_code: nil, dpop_jkt: nil,
+                     signed: false, saml: nil)
+        @signed = signed
+        @authorization_details_value = authorization_details.presence
+        @saml = saml.presence
+        @dpop_jkt = dpop_jkt.presence
+        @user_code = user_code.presence
+        @requested_claims = self.class.parse_claims(claims)
+        @request_object = request.presence
+        @request_uri = request_uri.presence
+        @client_id = client_id.to_s
+        @redirect_uri = redirect_uri.to_s
+        @response_type = response_type.to_s
+        @requested_scopes = Scopes.list(scope)
+        @state = state
+        @nonce = nonce
+        @code_challenge = code_challenge.presence
+        @code_challenge_method = (code_challenge_method.presence || ("S256" if @code_challenge))
+        @prompt = Scopes.list(prompt)
+        @max_age = max_age.presence&.to_i
+        @acr_values = Scopes.list(acr_values)
+        @organization = organization.to_s.strip.downcase.presence
+        @audience = Array(resource).map(&:to_s).reject(&:empty?).uniq
+      end
+
+      def client
+        @client ||= Client.authenticating(client_id, protocol: saml? ? SamlIdentity::PROTOCOL : Client::OIDC)
+      end
+
+      def saml?
+        @saml.present?
+      end
+
+      def authorization_details
+        return @authorization_details if defined?(@authorization_details)
+
+        @authorization_details = AuthorizationDetails.parse(@authorization_details_value)
+      end
+
+      def authorization_details_json
+        authorization_details&.canonical
+      rescue AuthorizationDetails::Invalid
+        value = @authorization_details_value
+
+        value.is_a?(String) ? value : value.to_json
+      end
+
+      def granted_scopes
+        @granted_scopes ||= client ? client.permitted_scopes(requested_scopes) : []
+      end
+
+      def scopes_for(actor)
+        return granted_scopes if actor.nil?
+
+        actor.permitted_scopes(granted_scopes)
+      end
+
+      def self.parse_claims(value)
+        return value if value.is_a?(Hash)
+        return nil if value.blank?
+
+        parsed = JSON.parse(value.to_s)
+        parsed.is_a?(Hash) ? parsed : nil
+      rescue JSON::ParserError
+        nil
+      end
+
+      def request_object?
+        @request_object.present?
+      end
+
+      def request_uri?
+        @request_uri.present?
+      end
+
+      def signed?
+        @signed
+      end
+
+      def reauthenticate?
+        prompt.include?("login")
+      end
+
+      def multi_factor?
+        [ acr_values, claimed_acr_values ].any? do |accepted|
+          (accepted & Issuer::ACR_VALUES) == [ Issuer::ACR_MULTI_FACTOR ]
+        end
+      end
+
+      def consent?
+        prompt.include?("consent") || device?
+      end
+
+      def silent?
+        prompt.include?("none")
+      end
+
+      def validate!
+        AuthorizationPolicy.new(self).call
+        self
+      end
+
+      def redirect_with(issuer:, **params)
+        uri = URI.parse(redirect_uri)
+        query = Rack::Utils.parse_query(uri.query)
+        query.merge!(params.transform_keys(&:to_s).compact)
+        query["state"] = state if state.present?
+        query["iss"] = issuer.url
+        uri.query = Rack::Utils.build_query(query)
+        uri.to_s
+      end
+
+      def canonical
+        {
+          "client_id" => client_id,
+          "redirect_uri" => redirect_uri,
+          "response_type" => response_type,
+          "scope" => Scopes.join(requested_scopes),
+          "state" => state,
+          "nonce" => nonce,
+          "code_challenge" => code_challenge,
+          "code_challenge_method" => code_challenge_method,
+          "prompt" => prompt.sort.join(" ").presence,
+          "max_age" => max_age,
+          "acr_values" => acr_values.join(" ").presence,
+          "organization" => organization,
+          "resource" => audience.sort,
+          "claims" => requested_claims&.to_json,
+          "authorization_details" => authorization_details_json,
+          "dpop_jkt" => dpop_jkt
+        }.compact
+      end
+
+      def device?
+        user_code.present?
+      end
+
+      def claimed_acr_values
+        wanted = requested_claims&.dig("id_token", "acr")
+
+        return [] unless wanted.is_a?(Hash)
+
+        Array(wanted["values"]) + Array(wanted["value"])
+      end
+
+      def fingerprint
+        Digest::SHA256.hexdigest(canonical.merge("user_code" => user_code, "saml" => saml).compact.to_json)
+      end
+
+      def to_params
+        canonical.reject { |_, value| value.blank? }
+      end
+
+      def query_pairs
+        pairs = canonical.except("resource").reject { |_, value| value.blank? }.to_a
+
+        audience.each { |value| pairs << [ "resource", value ] }
+        pairs
+      end
+    end
+  end
+end

data/app/models/masks/server/authorization_code.rb

@@ -0,0 +1,32 @@
+module Masks
+  module Server
+    class AuthorizationCode < Token
+      def self.lifetime
+        10.minutes
+      end
+
+      def revoke_issued!
+        children.sum(&:revoke!)
+      end
+
+      def pkce?
+        code_challenge.present?
+      end
+
+      def verifies?(verifier)
+        return !pkce? if verifier.blank?
+        return false unless pkce?
+
+        case code_challenge_method
+        when "S256"
+          expected = Base64.urlsafe_encode64(
+            OpenSSL::Digest::SHA256.digest(verifier.to_s), padding: false
+          )
+          ActiveSupport::SecurityUtils.secure_compare(expected, code_challenge)
+        else
+          false
+        end
+      end
+    end
+  end
+end

data/app/models/masks/server/authorization_details.rb

@@ -0,0 +1,235 @@
+module Masks
+  module Server
+    class AuthorizationDetails
+      class Invalid < StandardError; end
+
+      ENTRY_LIMIT = 10
+      BYTE_LIMIT = 8.kilobytes
+      TYPE_FORMAT = /\A[A-Za-z0-9_.:\/-]{1,200}\z/
+      SCHEMA_KEYWORDS = %w[type properties required additionalProperties items enum maxLength maxItems minimum maximum
+                           title description].freeze
+      SCHEMA_TYPES = %w[object array string number integer boolean].freeze
+      LABEL_LIMIT = 100
+
+      attr_reader :entries
+
+      class << self
+        def parse(value)
+          return nil if value.blank?
+
+          held = value.is_a?(String) ? JSON.parse(value) : value
+          held = held.map { |entry| entry.respond_to?(:to_unsafe_h) ? entry.to_unsafe_h : entry } if held.is_a?(Array)
+
+          raise Invalid, "authorization_details must be a JSON array" unless held.is_a?(Array)
+          raise Invalid, "authorization_details holds no entries" if held.empty?
+          raise Invalid, "authorization_details holds more than #{ENTRY_LIMIT} entries" if held.size > ENTRY_LIMIT
+          raise Invalid, "authorization_details is larger than #{BYTE_LIMIT / 1.kilobyte}KB" if held.to_json.bytesize > BYTE_LIMIT
+
+          new(held.map { |entry| entry!(entry) })
+        rescue JSON::ParserError
+          raise Invalid, "authorization_details is not JSON"
+        end
+
+        def declared
+          held = Current.authorization_details_declared ||= {}
+
+          held[Current.tenant&.id] ||=
+            Client.active.approved.where.not(authorization_details_schemas: {}).order(:id)
+                  .pluck(:authorization_details_schemas)
+                  .each_with_object({}) { |schemas, held| schemas.each { |type, declaration| held[type] ||= declaration } }
+        end
+
+        def narrow!(requested, granted)
+          held = parse(requested)
+
+          raise Invalid, "authorization_details asks for more than was granted" unless held.nil? || held.covered_by?(granted)
+
+          held
+        end
+
+        def supported_types
+          declared.keys.sort
+        end
+
+        def check_declaration!(declarations)
+          raise Invalid, "must map each type to its declaration" unless declarations.is_a?(Hash)
+
+          declarations.each do |type, declaration|
+            raise Invalid, "#{type.to_s.truncate(40).inspect} is not a type name" unless type.to_s.match?(TYPE_FORMAT)
+            raise Invalid, "#{type} must be declared as an object" unless declaration.is_a?(Hash)
+
+            label = declaration["label"]
+            raise Invalid, "#{type} needs a label of at most #{LABEL_LIMIT} characters" unless label.is_a?(String) && label.present? && label.length <= LABEL_LIMIT
+
+            remember = declaration["remember"]
+            unless remember.nil? || (remember.is_a?(Integer) && remember.positive? && remember <= Consent::LONGEST.to_i)
+              raise Invalid, "#{type} remember must be a number of seconds up to #{Consent::LONGEST.in_days.to_i} days"
+            end
+
+            schema = declaration["schema"]
+            raise Invalid, "#{type} needs a schema that describes an object" unless schema.is_a?(Hash) && schema["type"] == "object"
+
+            check_schema!(schema, type)
+          end
+
+          declarations
+        end
+
+        private
+
+          def entry!(entry)
+            raise Invalid, "each authorization_details entry must be a JSON object" unless entry.is_a?(Hash)
+
+            type = entry["type"]
+            raise Invalid, "each authorization_details entry needs a type" unless type.is_a?(String) && type.match?(TYPE_FORMAT)
+
+            entry.deep_stringify_keys
+          end
+
+          def check_schema!(schema, path)
+            raise Invalid, "#{path} must be a JSON object" unless schema.is_a?(Hash)
+
+            unknown = schema.keys - SCHEMA_KEYWORDS
+            raise Invalid, "#{path} uses #{unknown.join(', ')}, which masks does not read" if unknown.any?
+            raise Invalid, "#{path} needs a type of #{SCHEMA_TYPES.join(', ')}" unless SCHEMA_TYPES.include?(schema["type"])
+
+            Array(schema["properties"]).each { |name, child| check_schema!(child, "#{path}.#{name}") }
+            check_schema!(schema["items"], "#{path}[]") if schema["items"]
+          end
+      end
+
+      def initialize(entries)
+        @entries = entries
+      end
+
+      def types
+        entries.map { |entry| entry["type"] }.uniq
+      end
+
+      def as_json(*)
+        entries
+      end
+
+      def canonical
+        entries.map { |entry| normalized(entry) }.to_json
+      end
+
+      def covered_by?(granted)
+        held = Array(granted.is_a?(self.class) ? granted.entries : granted).map { |entry| normalized(entry) }
+
+        entries.all? { |entry| held.include?(normalized(entry)) }
+      end
+
+      def check!(client, declared: self.class.declared)
+        allowed = Array(client.authorization_details_types)
+
+        entries.each do |entry|
+          type = entry["type"]
+          declaration = declared[type]
+
+          raise Invalid, "#{type} is not a type of authorization detail this server accepts" if declaration.nil?
+          raise Invalid, "#{client.name} has not registered #{type} in its authorization_details_types" unless allowed.include?(type)
+
+          problem = Schema.new(declaration["schema"]).problem(entry.except("type"), type)
+          raise Invalid, problem if problem
+        end
+
+        self
+      end
+
+      def described(declared: self.class.declared)
+        entries.map do |entry|
+          declaration = declared[entry["type"]] || {}
+
+          {
+            "type" => entry["type"],
+            "label" => declaration["label"] || entry["type"],
+            "fields" => entry.except("type").map { |name, value| [ name, Array(value).map(&:to_s).join(", ") ] }
+          }
+        end
+      end
+
+      private
+
+        def normalized(value)
+          case value
+          when Hash then value.stringify_keys.sort.to_h.transform_values { |child| normalized(child) }
+          when Array then value.map { |child| normalized(child) }
+          else value
+          end
+        end
+
+      class Schema
+        def initialize(schema)
+          @schema = schema
+        end
+
+        def problem(value, path)
+          check(@schema, value, path)
+        end
+
+        private
+
+          def check(schema, value, path)
+            return "#{path} must be one of #{schema['enum'].map(&:to_s).join(', ')}" if schema["enum"] && !schema["enum"].include?(value)
+
+            case schema["type"]
+            when "object" then object(schema, value, path)
+            when "array" then array(schema, value, path)
+            when "string" then string(schema, value, path)
+            when "number", "integer" then number(schema, value, path)
+            when "boolean" then "#{path} must be true or false" unless [ true, false ].include?(value)
+            end
+          end
+
+          def object(schema, value, path)
+            return "#{path} must be an object" unless value.is_a?(Hash)
+
+            properties = schema["properties"] || {}
+
+            missing = Array(schema["required"]) - value.keys
+            return "#{path} needs #{missing.join(', ')}" if missing.any?
+
+            extra = value.keys - properties.keys
+            return "#{path} does not accept #{extra.join(', ')}" if extra.any? && schema["additionalProperties"] != true
+
+            value.each do |name, child|
+              next unless properties.key?(name)
+
+              found = check(properties[name], child, "#{path}.#{name}")
+              return found if found
+            end
+
+            nil
+          end
+
+          def array(schema, value, path)
+            return "#{path} must be an array" unless value.is_a?(Array)
+            return "#{path} holds more than #{schema['maxItems']} items" if schema["maxItems"] && value.size > schema["maxItems"]
+            return nil unless schema["items"]
+
+            value.each_with_index do |child, index|
+              found = check(schema["items"], child, "#{path}[#{index}]")
+              return found if found
+            end
+
+            nil
+          end
+
+          def string(schema, value, path)
+            return "#{path} must be a string" unless value.is_a?(String)
+
+            "#{path} is longer than #{schema['maxLength']} characters" if schema["maxLength"] && value.length > schema["maxLength"]
+          end
+
+          def number(schema, value, path)
+            return "#{path} must be a number" unless value.is_a?(Numeric)
+            return "#{path} must be a whole number" if schema["type"] == "integer" && !value.is_a?(Integer)
+            return "#{path} must be at least #{schema['minimum']}" if schema["minimum"] && value < schema["minimum"]
+
+            "#{path} must be at most #{schema['maximum']}" if schema["maximum"] && value > schema["maximum"]
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/authorize_request.rb

@@ -0,0 +1,57 @@
+module Masks
+  module Server
+    class AuthorizeRequest
+      PATH = "/authorize".freeze
+
+      attr_reader :request, :response, :error
+
+      def initialize(params)
+        @params = params
+      end
+
+      def run(&block)
+        handler = Rack::OAuth2::Server::Authorize.new do |request, response|
+          @request = request
+          @response = response
+
+          block.call(request, response)
+        end
+
+        @rack = handler.call(env)
+        self
+      rescue Rack::OAuth2::Server::Abstract::Error => error
+        @error = error
+        self
+      end
+
+      def refused?
+        error.present?
+      end
+
+      def answered?
+        @rack.present? && @rack.first.to_i != 200
+      end
+
+      def location
+        @rack[1]["Location"] || @rack[1]["location"]
+      end
+
+      def approve!(code)
+        response.code = code
+        response.approve!
+        response.finish
+      end
+
+      private
+
+        def env
+          {
+            "REQUEST_METHOD" => "GET",
+            "PATH_INFO" => PATH,
+            "QUERY_STRING" => Rack::Utils.build_query(@params),
+            "rack.input" => StringIO.new("")
+          }
+        end
+    end
+  end
+end

data/app/models/masks/server/avatar.rb

@@ -0,0 +1,52 @@
+module Masks
+  module Server
+    class Avatar < ApplicationRecord
+      include TenantScoped
+
+      STORED = 512
+      LIMIT = 8.megabytes
+
+      belongs_to :actor
+
+      validates :actor_id, uniqueness: { scope: :tenant_id }
+
+      def self.store!(actor:, upload:)
+        refuse_size!(upload.size) if upload.respond_to?(:size)
+
+        bytes = bytes_in(upload)
+
+        raise Pictures::Unreadable, "an avatar has to be an image" if Pictures.sniff(bytes).nil?
+
+        refuse_size!(bytes.bytesize)
+
+        square = Pictures.square(bytes, STORED)
+        held = find_or_initialize_by(actor_id: actor.id)
+
+        held.update!(
+          content_type: Pictures::CONTENT_TYPE,
+          digest: Pictures.digest(square),
+          byte_size: square.bytesize,
+          data: square
+        )
+
+        held
+      end
+
+      def self.refuse_size!(size)
+        return if size.nil? || size <= LIMIT
+
+        raise Pictures::Unreadable, "an avatar has to be smaller than #{LIMIT / 1.megabyte}MB"
+      end
+
+      def self.bytes_in(upload)
+        return upload.read(LIMIT + 1).to_s.b if upload.respond_to?(:read)
+
+        upload.to_s.b
+      end
+
+      def resized(size)
+        Pictures.resized(data, digest, size, stored: STORED, kind: "avatar")
+      end
+    end
+  end
+end

data/app/models/masks/server/avatars.rb

@@ -0,0 +1,99 @@
+module Masks
+  module Server
+    module Avatars
+      PHOTO = "photo".freeze
+      IDENTICON = "identicon".freeze
+      INITIALS = "initials".freeze
+
+      STYLES = [ PHOTO, IDENTICON, INITIALS ].freeze
+      GENERATED = [ IDENTICON, INITIALS ].freeze
+      FALLBACK = IDENTICON
+      SIZES = [ 32, 64, 128, 256, 512 ].freeze
+
+      class << self
+        def style?(value)
+          STYLES.include?(value.to_s)
+        end
+
+        def generated?(value)
+          GENERATED.include?(value.to_s)
+        end
+
+        def size(value)
+          return nil if value.blank?
+
+          SIZES.find { |allowed| allowed >= value.to_i } || SIZES.last
+        end
+
+        def photo(actor)
+          Avatar.find_by(actor_id: actor.id)
+        end
+
+        def identicon(actor)
+          Identicon.new(actor.uuid)
+        end
+
+        def initials(actor)
+          Initials.new(actor.uuid, actor.name, actor.nickname, actor.email&.split("@")&.first)
+        end
+
+        def held?(actor)
+          photo(actor).present?
+        end
+
+        def digest(actor, style)
+          case style.to_s
+          when PHOTO then photo(actor)&.digest
+          when IDENTICON then identicon(actor).digest
+          when INITIALS then initials(actor).digest
+          end
+        end
+
+        def render(actor, style, size: nil)
+          case style.to_s
+          when PHOTO then rendered_photo(actor, size)
+          when IDENTICON then [ Identicon::CONTENT_TYPE, identicon(actor).to_svg(size) ]
+          when INITIALS then [ Initials::CONTENT_TYPE, initials(actor).to_svg(size) ]
+          end
+        end
+
+        def url(actor, style, subject:, origin: Current.origin, size: nil)
+          return nil if origin.blank?
+
+          held = digest(actor, style)
+          return nil if held.nil?
+
+          query = size ? "?size=#{size}" : ""
+
+          "#{origin}/avatars/#{subject}/#{style}/#{held}#{query}"
+        end
+
+        def urls(actor, subject:, origin: Current.origin)
+          return nil if origin.blank?
+
+          {
+            PHOTO => (url(actor, PHOTO, subject: subject, origin: origin) if held?(actor)),
+            IDENTICON => url(actor, IDENTICON, subject: subject, origin: origin),
+            INITIALS => url(actor, INITIALS, subject: subject, origin: origin)
+          }
+        end
+
+        def picture(actor, subject:, origin: Current.origin)
+          return actor.picture_url if actor.picture_url.present?
+
+          url(actor, held?(actor) ? PHOTO : FALLBACK, subject: subject, origin: origin)
+        end
+
+        private
+
+          def rendered_photo(actor, size)
+            held = photo(actor)
+
+            return nil if held.nil?
+
+            [ held.content_type, held.resized(size) ]
+          end
+      end
+    end
+  end
+end