masks-server 0.7.0

data/app/models/masks/server/backchannel_logout.rb

@@ -0,0 +1,67 @@
+module Masks
+  module Server
+    module BackchannelLogout
+      class Refused < StandardError; end
+
+      def self.announce(session)
+        origin = session.origin.presence || Current.origin.presence || session.tenant.public_origin
+
+        return if origin.blank?
+
+        session.relying_parties.find_each do |client|
+          BackchannelLogoutJob.perform_later(
+            client_id: client.client_id,
+            subject: Subjects.for(session.actor, client),
+            actor: session.actor.uuid,
+            sid: session.uuid,
+            origin: origin
+          )
+        end
+
+        SamlParticipation.claim!(session.saml_participations).each do |participation|
+          SamlLogoutJob.perform_later(
+            client_id: participation.client.client_id,
+            name_id: participation.name_id,
+            name_id_format: participation.name_id_format,
+            session_index: participation.session_index,
+            actor: session.actor.uuid,
+            origin: origin
+          )
+        end
+      end
+
+      def self.deliver!(client, token)
+        uri = URI.parse(client.backchannel_logout_uri)
+
+        response = Outbound.post(uri, { logout_token: token }, address: routable!(client, uri))
+
+        return true if response.is_a?(Net::HTTPSuccess)
+
+        raise Refused, "#{client.name} answered #{response.code}"
+      rescue *Outbound::UNREADABLE, URI::InvalidURIError => e
+        raise Refused, "#{client.name} could not be reached: #{e.class}"
+      end
+
+      def self.deliver_saml!(sign_off)
+        client = sign_off.client
+        uri = URI.parse(sign_off.destination)
+
+        response = Outbound.post(uri, { SAMLRequest: sign_off.encoded }, address: routable!(client, uri))
+
+        return true if response.is_a?(Net::HTTPSuccess) || response.is_a?(Net::HTTPRedirection)
+
+        raise Refused, "#{client.name} answered #{response.code}"
+      rescue *Outbound::UNREADABLE, URI::InvalidURIError => e
+        raise Refused, "#{client.name} could not be reached: #{e.class}"
+      end
+
+      def self.routable!(client, uri)
+        return if ::Rails.env.local?
+
+        raise Refused, "#{client.name} is not reachable over http" unless uri.is_a?(URI::HTTP)
+
+        Outbound.vetted(uri) || raise(Refused, "#{client.name} resolves to an address this server will not call")
+      end
+    end
+  end
+end

data/app/models/masks/server/breached_passwords.rb

@@ -0,0 +1,29 @@
+module Masks
+  module Server
+    module BreachedPasswords
+      RANGE_URL = "https://api.pwnedpasswords.com/range/".freeze
+      PREFIX = 5
+      WITHIN = 3
+
+      class << self
+        def breached?(password)
+          return false if password.blank?
+
+          digest = Digest::SHA1.hexdigest(password.to_s).upcase
+          prefix = digest[0, PREFIX]
+          suffix = digest[PREFIX..]
+
+          body = Outbound.fetch!(URI.parse("#{RANGE_URL}#{prefix}"), open: WITHIN, read: WITHIN, within: WITHIN)
+
+          body.each_line.any? do |line|
+            held, count = line.strip.split(":", 2)
+
+            held.present? && ActiveSupport::SecurityUtils.secure_compare(held, suffix) && count.to_i.positive?
+          end
+        rescue Outbound::Refused, URI::InvalidURIError
+          false
+        end
+      end
+    end
+  end
+end

data/app/models/masks/server/client.rb

@@ -0,0 +1,604 @@
+module Masks
+  module Server
+    class Client < ApplicationRecord
+      include TenantScoped
+      include Archivable
+      include Paged
+
+      OIDC = "oidc".freeze
+      PRIVATE_KEY_JWT = "private_key_jwt".freeze
+      SECRET_AUTH_METHODS = %w[client_secret_basic client_secret_post].freeze
+      AUTH_METHODS = (SECRET_AUTH_METHODS + [ PRIVATE_KEY_JWT, "none" ]).freeze
+      FORWARD = "forward".freeze
+      FORWARD_CALLBACK = "/masks-auth/callback".freeze
+      ALLOWED_GROUP = /\A[a-z0-9][a-z0-9._-]*(:[a-z0-9._-]+)?\z/
+      DEFAULT_AUTH_METHOD = "client_secret_basic".freeze
+      CLIENT_CREDENTIALS = "client_credentials".freeze
+      REDIRECTED_GRANT_TYPES = %w[authorization_code].freeze
+      GRANT_TYPES = [
+        "authorization_code",
+        "refresh_token",
+        CLIENT_CREDENTIALS,
+        DeviceGrant::GRANT_TYPE,
+        Exchange::GRANT_TYPE
+      ].freeze
+      RESPONSE_TYPES = %w[code].freeze
+      CHALLENGE_METHODS = %w[S256].freeze
+      LOOPBACK = %w[localhost 127.0.0.1 ::1].freeze
+      DEFAULT_SCOPES = Scopes::STANDARD
+      LINKS = %i[client_uri tos_uri policy_uri].freeze
+      METADATA_URIS = (LINKS + [ :logo_uri ]).freeze
+      URI_LIMIT = 2048
+      SCRIPTED_SCHEMES = %w[javascript data vbscript file blob about].freeze
+      METADATA_STRINGS = %w[
+        token_endpoint_auth_method subject_type sector_identifier_uri application_type client_uri logo_uri tos_uri
+        policy_uri backchannel_logout_uri jwks jwks_uri
+      ].freeze
+      METADATA_LISTS = %w[redirect_uris post_logout_redirect_uris resources authorization_details_types].freeze
+      METADATA_SCOPES = %w[grant_types response_types].freeze
+      METADATA_FLAGS = %w[
+        dpop_bound_access_tokens backchannel_logout_session_required require_pushed_authorization_requests
+        require_signed_request_object
+      ].freeze
+      APPROVED = %i[
+        redirect_uris post_logout_redirect_uris token_endpoint_auth_method resources
+        subject_type sector_identifier_uri dpop_bound_access_tokens grant_types response_types
+        authorization_details_types
+      ].freeze
+
+      class ScopesUnavailable < StandardError; end
+
+      has_many :tokens, dependent: :destroy
+      has_many :consents, dependent: :destroy
+      has_many :delegations, dependent: :destroy
+      has_many :saml_participations, dependent: :delete_all
+      has_many :namespaces, -> { order(:name) }, dependent: :nullify
+      has_one :logo, class_name: "ClientLogo", dependent: :delete
+
+      validate :allowed_groups_are_named
+      validates :client_id, presence: true, uniqueness: { scope: :tenant_id }
+      validates :name, presence: true
+      validates :token_endpoint_auth_method, inclusion: { in: AUTH_METHODS }
+      validates :protocol, inclusion: { in: [ OIDC, SamlIdentity::PROTOCOL, FORWARD ] }
+      validates :saml_entity_id, uniqueness: { scope: :tenant_id }, allow_nil: true
+      validates :subject_type, inclusion: { in: Subjects::TYPES }
+      validate :redirect_uris_are_usable
+      validate :post_logout_redirect_uris_are_usable
+      validate :grant_types_are_known
+      validate :client_credentials_are_confidential
+      validate :keys_are_usable
+      validate :saml_is_described, if: :saml?
+      validate :forward_is_described, if: :forward?
+      validate :backchannel_logout_uri_is_usable
+      validate :sector_is_derivable
+      validate :consent_is_skipped_only_when_approved
+      validate :sector_identifier_uri_is_owned, if: :sector_declared?
+      validate :metadata_uris_are_usable
+      validate :authorization_details_are_declared
+      validate :resources_are_named_only_when_approved
+      validates :access_token_lifetime, numericality: { only_integer: true, in: 60..1.day.to_i }, allow_nil: true
+      validates :refresh_token_lifetime, numericality: { only_integer: true, in: 5.minutes.to_i..400.days.to_i }, allow_nil: true
+      validates :consent_lifetime, numericality: { only_integer: true, greater_than_or_equal_to: 300,
+                                                   less_than_or_equal_to: Consent::LONGEST.to_i }, allow_nil: true
+
+      normalizes :allowed_groups, with: ->(value) { Array(value).map { |group| group.to_s.strip.downcase }.compact_blank.uniq.sort }
+      normalizes :saml_entity_id, :saml_slo_url, with: ->(value) { value.to_s.strip.presence }
+      normalizes(*METADATA_URIS, with: ->(value) { value.to_s.strip.presence })
+
+      after_commit :refresh_logo!, on: %i[create update], if: :saved_change_to_logo_uri?
+
+      belongs_to :approved_by, class_name: "Actor", optional: true
+      belongs_to :sign_in_policy, optional: true
+
+      scope :approved, -> { where.not(approved_at: nil) }
+      scope :speaking, ->(protocol) { active.where(protocol: protocol) }
+
+      attr_reader :secret, :registration_token
+
+      class << self
+        def loopback?(uri)
+          host = uri.host.to_s
+
+          LOOPBACK.include?(host) || host.end_with?(".localhost")
+        end
+
+        def approve!(handshake, actor:)
+          client = approved_for(handshake.resource) || new(client_id: SecureRandom.uuid)
+
+          client.assign_attributes(
+            described_by(handshake).merge(approved_at: Time.current, approved_by: actor, archived_at: nil)
+          )
+
+          client.save!
+          client
+        end
+
+        def described_by(handshake)
+          {
+            name: handshake.name,
+            redirect_uris: handshake.redirect_uris,
+            post_logout_redirect_uris: [ handshake.return_to ].compact,
+            resources: [ handshake.resource ],
+            allowed_scopes: Scopes.join(handshake.scopes),
+            grant_types: handshake.grant_types,
+            response_types: [ "code" ],
+            token_endpoint_auth_method: handshake.auth_method,
+            backchannel_logout_uri: handshake.backchannel_logout_uri,
+            client_uri: handshake.origin,
+            dynamic: false
+          }
+        end
+
+        def approved_for(resource)
+          return nil if resource.blank?
+
+          active.approved.where("resources @> ?", [ resource.to_s ].to_json).first
+        end
+
+        def register!(metadata)
+          new(client_id: SecureRandom.uuid, **registered_attributes(metadata, name: "Unnamed client")).issue_credentials!
+        end
+
+        def metadata_attributes(metadata)
+          held = metadata.to_h.stringify_keys.compact_blank
+
+          held.slice(*METADATA_STRINGS)
+              .merge(held.slice(*METADATA_LISTS).transform_values { |value| Array(value).map(&:to_s) })
+              .merge(held.slice(*METADATA_SCOPES).transform_values { |value| Scopes.list(value) })
+              .merge(held.slice(*METADATA_FLAGS).transform_values { |value| ActiveModel::Type::Boolean.new.cast(value) })
+              .merge(held.key?("client_name") ? { "name" => held["client_name"] } : {})
+              .symbolize_keys
+        end
+
+        def registered_attributes(metadata, name:, auth_method: DEFAULT_AUTH_METHOD)
+          held = metadata_attributes(metadata)
+          asked = held[:grant_types].presence || [ "authorization_code" ]
+          grant_types = (asked & GRANT_TYPES).presence || asked
+
+          {
+            token_endpoint_auth_method: auth_method,
+            subject_type: Subjects::PUBLIC,
+            application_type: "web"
+          }.merge(held).merge(
+            name: held[:name] || name,
+            grant_types: grant_types,
+            response_types: held[:response_types].presence || response_types_for(grant_types),
+            allowed_scopes: Scopes.join(bounded(metadata.to_h.stringify_keys["scope"].presence ||
+                                                Current.tenant&.dynamic_client_ceiling || DEFAULT_SCOPES)),
+            dynamic: true
+          )
+        end
+
+        def bounded(requested)
+          reserved = Scopes.reserved(requested) + Scopes.list(requested).select { |s| Scopes.prefix?(s) }
+
+          if reserved.any?
+            raise ScopesUnavailable,
+                  "#{Scopes.join(reserved.uniq)} may only be granted to an approved client"
+          end
+
+          ceiling = Current.tenant&.dynamic_client_ceiling
+          bounded = ceiling ? Scopes.granted(requested, ceiling) : Scopes.list(requested)
+
+          if bounded.empty?
+            raise ScopesUnavailable,
+                  "a dynamically registered client may not request #{Scopes.join(requested)}"
+          end
+
+          bounded
+        end
+
+        def response_types_for(grant_types)
+          (Array(grant_types) & REDIRECTED_GRANT_TYPES).any? ? [ "code" ] : []
+        end
+
+        def authenticating(client_id, protocol: OIDC)
+          return ClientMetadataDocument.resolve(client_id.to_s) if protocol == OIDC && ClientMetadataDocument.url?(client_id)
+
+          speaking(protocol).find_by(client_id: client_id.to_s)
+        end
+
+        def forwarding_to(uri)
+          origin = Forwarded.origin(uri)
+          return nil if origin.nil?
+
+          speaking(FORWARD).approved.where("redirect_uris @> ?", [ "#{origin}#{FORWARD_CALLBACK}" ].to_json).first
+        end
+
+        def saml_for(entity_id)
+          speaking(SamlIdentity::PROTOCOL).find_by(saml_entity_id: entity_id.to_s)
+        end
+
+        def by_registration_token(token)
+          return nil if token.blank?
+
+          active.find_by(registration_token_digest: Digest::SHA256.hexdigest(token.to_s))
+        end
+      end
+
+      def public?
+        token_endpoint_auth_method == "none"
+      end
+
+      def approved_as?(handshake)
+        described = self.class.described_by(handshake)
+        candidate = self.class.new(described)
+
+        described.keys.all? { |key| public_send(key) == candidate.public_send(key) }
+      end
+
+      def asserts?
+        token_endpoint_auth_method == PRIVATE_KEY_JWT
+      end
+
+      def secret?
+        SECRET_AUTH_METHODS.include?(token_endpoint_auth_method)
+      end
+
+      def pairwise?
+        subject_type == Subjects::PAIRWISE
+      end
+
+      def sector_identifier
+        return SectorIdentifier.host(sector_identifier_uri) if sector_identifier_uri.present?
+
+        redirect_hosts.one? ? redirect_hosts.first : nil
+      end
+
+      def redirect_hosts
+        redirect_uris.filter_map { |value| SectorIdentifier.host(value) }.uniq
+      end
+
+      def approved?
+        approved_at.present?
+      end
+
+      def document?
+        metadata_expires_at.present?
+      end
+
+      def metadata_stale?
+        document? && metadata_expires_at.past?
+      end
+
+      def logo_shown_to?(viewer)
+        logo_digest.present? && (approved? || viewer&.manages? || false)
+      end
+
+      def logo_url(viewer, size: nil)
+        return nil unless logo_shown_to?(viewer)
+
+        "#{Current.origin}#{Engine.routes.url_helpers.client_logo_path(client_id, v: logo_digest, size: size)}"
+      end
+
+      def link(field)
+        value = public_send(field)
+
+        value if LINKS.include?(field) && value.present? && web_uri_refusal(value).nil?
+      end
+
+      def refresh_logo!
+        ClientLogoJob.perform_later(id)
+      end
+
+      def issue_credentials!
+        issue_secret! if secret?
+        issue_registration_token!
+        save!
+        self
+      end
+
+      def issue_secret!
+        @secret = SecureRandom.urlsafe_base64(48)
+        self.secret_digest = BCrypt::Password.create(@secret)
+        @secret
+      end
+
+      def issue_registration_token!
+        @registration_token = SecureRandom.urlsafe_base64(48)
+        self.registration_token_digest = Digest::SHA256.hexdigest(@registration_token)
+        @registration_token
+      end
+
+      def authenticate_secret(candidate)
+        return true if public?
+        return false unless secret?
+        return false if secret_digest.blank? || candidate.blank?
+
+        BCrypt::Password.new(secret_digest) == candidate.to_s
+      rescue BCrypt::Errors::InvalidHash
+        false
+      end
+
+      def redirect_uri?(candidate)
+        redirect_uris.include?(candidate.to_s)
+      end
+
+      def grants?(grant_type)
+        grant_types.include?(grant_type.to_s)
+      end
+
+      def redirects?
+        saml? || (grant_types & REDIRECTED_GRANT_TYPES).any?
+      end
+
+      def saml?
+        protocol == SamlIdentity::PROTOCOL
+      end
+
+      def forward?
+        protocol == FORWARD
+      end
+
+      def forward_origin
+        Forwarded.origin(redirect_uris.first) if forward?
+      end
+
+      def keys?
+        jwks.present? || jwks_uri.present?
+      end
+
+      def default_response_types
+        self.class.response_types_for(grant_types)
+      end
+
+      def saml_x509_certificate
+        return nil if saml_certificate.blank?
+
+        OpenSSL::X509::Certificate.new(OneLogin::RubySaml::Utils.format_cert(saml_certificate.to_s.strip))
+      rescue OpenSSL::X509::CertificateError
+        nil
+      end
+
+      def unattended_scopes
+        Scopes.unattended(scope_list)
+      end
+
+      def scope_list
+        Scopes.union(required_scopes, allowed_scopes)
+      end
+
+      def access_lifetime
+        access_token_lifetime&.seconds || AccessToken.lifetime
+      end
+
+      def refresh_lifetime
+        refresh_token_lifetime&.seconds || RefreshToken.lifetime
+      end
+
+      def admits?(actor)
+        allowed_groups.empty? || actor.group_labels.intersect?(allowed_groups)
+      end
+
+      def permitted_scopes(requested)
+        return scope_list if Scopes.list(requested).empty?
+
+        Scopes.union(required_scopes, Scopes.granted(requested, allowed_scopes))
+      end
+
+      def metadata
+        {
+          "protocol" => (protocol unless protocol == OIDC),
+          "client_id" => client_id,
+          "client_name" => name,
+          "redirect_uris" => redirect_uris,
+          "post_logout_redirect_uris" => post_logout_redirect_uris.presence,
+          "grant_types" => grant_types,
+          "response_types" => response_types,
+          "scope" => Scopes.join(scope_list),
+          "token_endpoint_auth_method" => token_endpoint_auth_method,
+          "subject_type" => subject_type,
+          "dpop_bound_access_tokens" => dpop_bound_access_tokens,
+          "sector_identifier_uri" => sector_identifier_uri,
+          "application_type" => application_type,
+          "client_uri" => client_uri,
+          "logo_uri" => logo_uri,
+          "tos_uri" => tos_uri,
+          "policy_uri" => policy_uri,
+          "backchannel_logout_uri" => backchannel_logout_uri,
+          "backchannel_logout_session_required" => backchannel_logout_session_required,
+          "require_pushed_authorization_requests" => require_pushed_authorization_requests,
+          "require_signed_request_object" => require_signed_request_object,
+          "jwks" => jwks.presence,
+          "jwks_uri" => jwks_uri.presence,
+          "authorization_details_types" => authorization_details_types.presence,
+          "client_id_issued_at" => created_at&.to_i
+        }.compact
+      end
+
+      def notified_on_logout?
+        backchannel_logout_uri.present?
+      end
+
+      private
+
+        def allowed_groups_are_named
+          unknown = allowed_groups.grep_v(ALLOWED_GROUP)
+
+          errors.add(:allowed_groups, "names #{unknown.join(', ')}, which is not a group key or key:role") if unknown.any?
+        end
+
+        def consent_is_skipped_only_when_approved
+          return if consent_required? || approved?
+
+          errors.add(:consent_required, "may only be switched off for an approved client")
+        end
+
+        def backchannel_logout_uri_is_usable
+          return if backchannel_logout_uri.blank?
+
+          refusal = web_uri_refusal(backchannel_logout_uri.to_s, fetched: true)
+          errors.add(:backchannel_logout_uri, refusal) if refusal
+        end
+
+        def redirect_uris_are_usable
+          if redirect_uris.blank?
+            errors.add(:redirect_uris, "must include at least one URI") if redirects?
+            return
+          end
+
+          redirect_uris.each { |value| redirect_refusal(:redirect_uris, value) }
+        end
+
+        def post_logout_redirect_uris_are_usable
+          Array(post_logout_redirect_uris).each { |value| redirect_refusal(:post_logout_redirect_uris, value) }
+        end
+
+        def redirect_refusal(attribute, value)
+          uri = URI.parse(value.to_s)
+
+          if uri.fragment.present?
+            errors.add(attribute, "must not contain a fragment: #{value}")
+          elsif uri.scheme.blank?
+            errors.add(attribute, "must be absolute: #{value}")
+          elsif SCRIPTED_SCHEMES.include?(uri.scheme.downcase)
+            errors.add(attribute, "must not use the #{uri.scheme.downcase} scheme: #{value}")
+          elsif uri.scheme.casecmp?("http") && !loopback?(uri) && !::Rails.env.local?
+            errors.add(attribute, "must use https unless it is loopback: #{value}")
+          end
+        rescue URI::InvalidURIError
+          errors.add(attribute, "is not a URI: #{value}")
+        end
+
+        def loopback?(uri)
+          self.class.loopback?(uri)
+        end
+
+        def grant_types_are_known
+          unknown = grant_types - GRANT_TYPES
+          errors.add(:grant_types, "not supported: #{unknown.join(', ')}") if unknown.any?
+        end
+
+        def forward_is_described
+          errors.add(:grant_types, "are not used by an app behind a proxy") if grant_types.any?
+          errors.add(:token_endpoint_auth_method, "is none for an app behind a proxy") unless public?
+
+          unless redirect_uris.one? && redirect_uris.first.to_s.end_with?(FORWARD_CALLBACK) && forward_origin
+            errors.add(:redirect_uris, "hold the app's own #{FORWARD_CALLBACK}, and nothing else")
+          end
+        end
+
+        def saml_is_described
+          errors.add(:saml_entity_id, "is required for a SAML application") if saml_entity_id.blank?
+          errors.add(:grant_types, "are not used by a SAML application") if grant_types.any?
+          errors.add(:token_endpoint_auth_method, "is none for a SAML application") unless public?
+          errors.add(:saml_certificate, "is not a certificate masks can read") if saml_certificate.present? && saml_x509_certificate.nil?
+          errors.add(:saml_certificate, "is required to check signed requests") if saml_requests_signed? && saml_certificate.blank?
+          saml_slo_url&.then { |url| web_uri_refusal(url, fetched: true) }&.then { |refusal| errors.add(:saml_slo_url, refusal) }
+
+          if saml_name_id_format.present? && !SamlIdentity::NAME_ID_FORMATS.include?(saml_name_id_format)
+            errors.add(:saml_name_id_format, "is not one masks issues")
+          end
+
+          unless saml_attributes.is_a?(Hash) && saml_attributes.all? { |name, claim| name.to_s.match?(/\A[\w:.\/-]{1,256}\z/) && claim.is_a?(String) }
+            errors.add(:saml_attributes, "map attribute names to claim names")
+          end
+        end
+
+        def client_credentials_are_confidential
+          return unless grants?(CLIENT_CREDENTIALS)
+
+          errors.add(:grant_types, "client_credentials needs a client that authenticates, not a public one") if public?
+          errors.add(:grant_types, "client_credentials may only be granted to an approved client") unless approved?
+        end
+
+        def keys_are_usable
+          errors.add(:jwks, "and jwks_uri cannot both be registered") if jwks.present? && jwks_uri.present?
+
+          if require_signed_request_object? && !keys?
+            errors.add(:require_signed_request_object, "needs jwks or a jwks_uri to check request objects against")
+          end
+
+          if asserts? && !keys?
+            errors.add(:token_endpoint_auth_method, "private_key_jwt needs jwks or a jwks_uri to check assertions against")
+          end
+
+          self.jwks = ClientKeys.check!(jwks) if jwks.present? && will_save_change_to_jwks?
+          ClientKeys.fetch(jwks_uri) if jwks_uri.present? && will_save_change_to_jwks_uri?
+        rescue ClientKeys::Refused => e
+          errors.add(jwks_uri.present? && jwks.blank? ? :jwks_uri : :jwks, e.message)
+        end
+
+        def sector_declared?
+          sector_identifier_uri.present? &&
+            (sector_identifier_uri_changed? || redirect_uris_changed?)
+        end
+
+        def metadata_uris_are_usable
+          METADATA_URIS.each do |field|
+            value = public_send(field)
+
+            next if value.blank? || !will_save_change_to_attribute?(field)
+
+            refusal = web_uri_refusal(value, fetched: field == :logo_uri)
+            errors.add(field, refusal) if refusal
+          end
+        end
+
+        def web_uri_refusal(value, fetched: false)
+          return "must be at most #{URI_LIMIT} characters" if value.length > URI_LIMIT
+
+          uri = URI.parse(value)
+
+          if !uri.is_a?(URI::HTTP)
+            "must be an http or https URL"
+          elsif uri.host.blank?
+            "must be absolute"
+          elsif uri.userinfo.present?
+            "must not carry a username or password"
+          elsif fetched && uri.fragment.present?
+            "must not contain a fragment"
+          elsif fetched && dynamic? && !::Rails.env.local?
+            dynamic_fetch_refusal(uri)
+          elsif uri.scheme == "http" && !loopback?(uri) && !::Rails.env.local?
+            "must use https unless it is loopback"
+          end
+        rescue URI::InvalidURIError
+          "is not a URI"
+        end
+
+        def dynamic_fetch_refusal(uri)
+          return "must not point at a loopback address" if loopback?(uri)
+
+          "must use https" unless uri.scheme == "https"
+        end
+
+        def resources_are_named_only_when_approved
+          return unless dynamic? && !approved? && resources.any? && will_save_change_to_resources?
+
+          errors.add(:resources, "may only be named by an approved client, since tokens for a resource are trusted by it")
+        end
+
+        def authorization_details_are_declared
+          types = authorization_details_types
+
+          unless types.is_a?(Array) && types.size <= 20 && types.all? { |type| type.is_a?(String) && type.match?(AuthorizationDetails::TYPE_FORMAT) }
+            errors.add(:authorization_details_types, "must be a list of at most 20 type names")
+          end
+
+          return if authorization_details_schemas.blank? || !will_save_change_to_authorization_details_schemas?
+          return errors.add(:authorization_details_schemas, "may only be declared by an approved client") unless approved?
+
+          AuthorizationDetails.check_declaration!(authorization_details_schemas)
+        rescue AuthorizationDetails::Invalid => e
+          errors.add(:authorization_details_schemas, e.message)
+        end
+
+        def sector_is_derivable
+          return unless pairwise?
+          return if sector_identifier.present?
+
+          errors.add(
+            :sector_identifier_uri,
+            "is required when the redirect URIs do not share one host"
+          )
+        end
+
+        def sector_identifier_uri_is_owned
+          SectorIdentifier.verify!(sector_identifier_uri, redirect_uris)
+        rescue SectorIdentifier::Refused => e
+          errors.add(:sector_identifier_uri, e.message)
+        end
+    end
+  end
+end