masks-server 0.7.0

data/app/controllers/masks/server/avatars_controller.rb

@@ -0,0 +1,118 @@
+module Masks
+  module Server
+    class AvatarsController < ApplicationController
+      include RackOAuth2Endpoint
+      include ResourceToken
+      include ServesPictures
+
+      skip_before_action :refuse_blocked_device, only: :show
+
+      def show
+        actor = Subjects.locate(params[:uuid])
+
+        return head :not_found if actor.nil?
+
+        style = requested_style(actor)
+
+        return head :not_found if style.nil?
+        return refuse_photo if style == Avatars::PHOTO && !may_see_photo?(actor)
+
+        stamp = Avatars.digest(actor, style)
+
+        return head :not_found if stamp.nil?
+        return redirect_to stamped_avatar_path(params[:uuid], style, stamp, **size_param) if stale?(stamp)
+
+        deliver(actor, style, stamp)
+      end
+
+      def create
+        return head :unauthorized if current_actor.nil?
+
+        Avatar.store!(actor: current_actor, upload: params[:avatar])
+
+        Event.record!(Event::AVATAR_UPLOADED, actor: current_actor)
+
+        redirect_to root_path, flash: { avatar: t("avatars.updated") }
+      rescue Pictures::Unreadable => e
+        redirect_to root_path, alert: e.message
+      end
+
+      def destroy
+        return head :unauthorized if current_actor.nil?
+
+        removed = Avatars.photo(current_actor)&.destroy!
+
+        Event.record!(Event::AVATAR_REMOVED, actor: current_actor) if removed
+
+        redirect_to root_path, flash: { avatar: t("avatars.removed") }
+      end
+
+      private
+
+        def requested_style(actor)
+          asked = params[:style].presence
+
+          return fallback_for(actor) if asked.nil?
+          return nil unless Avatars.style?(asked)
+
+          asked
+        end
+
+        def fallback_for(actor)
+          return Avatars::FALLBACK unless Avatars.held?(actor) && may_see_photo?(actor)
+
+          Avatars::PHOTO
+        end
+
+        def stale?(stamp)
+          params[:digest].present? && params[:digest] != stamp
+        end
+
+        def size_param
+          held = params[:size].presence
+
+          held ? { size: held } : {}
+        end
+
+        def deliver(actor, style, stamp)
+          deliver_picture(stamp, cache_control: caching(style, stamp), vary: ("Cookie, Authorization" unless named_style?)) do
+            Avatars.render(actor, style, size: Avatars.size(params[:size]))
+          end
+        end
+
+        def named_style?
+          params[:style].present?
+        end
+
+        def caching(style, stamp)
+          shared = named_style? && Avatars.generated?(style) ? "public" : "private"
+          age = params[:digest] == stamp ? FOREVER : BRIEFLY
+          immutable = params[:digest] == stamp ? ", immutable" : ""
+
+          "#{shared}, max-age=#{age}#{immutable}"
+        end
+
+        def may_see_photo?(actor)
+          return true if current_actor&.id == actor.id
+          return true if current_actor&.manages?
+          return false if bearer.nil?
+          return true if ManageRoles.any?(bearer.scope_list) && ManageRoles.any?(bearer.actor&.scope_list)
+
+          bearer.actor_id == actor.id && bearer.scope_list.include?(Scopes::PROFILE)
+        end
+
+        def refuse_photo
+          response.headers["WWW-Authenticate"] =
+            %(Bearer realm="#{issuer.url}", scope="#{Scopes::PROFILE}")
+
+          head :unauthorized
+        end
+
+        def bearer
+          return @bearer if defined?(@bearer)
+
+          @bearer = presented_access_token
+        end
+    end
+  end
+end

data/app/controllers/masks/server/backup_codes_controller.rb

@@ -0,0 +1,29 @@
+module Masks
+  module Server
+    class BackupCodesController < ApplicationController
+      before_action :require_actor
+      before_action -> { reauthenticated!("backup-codes", t("backup_codes.again")) }
+
+      def create
+        return refuse(t("backup_codes.unoffered")) unless AuthenticatorApp.backup_codes_offered?(current_actor)
+        return refuse(t("backup_codes.no_second_factor")) unless current_actor.second_factor?
+
+        codes = current_actor.generate_backup_codes!
+        Event.record!(Event::BACKUP_CODES_GENERATED, actor: current_actor, count: codes.length)
+
+        flash[:backup_codes] = codes
+        redirect_to root_path(anchor: "backup-codes"), notice: t("backup_codes.generated")
+      end
+
+      private
+
+        def require_actor
+          redirect_to login_path unless current_actor
+        end
+
+        def refuse(message)
+          redirect_to root_path(anchor: "backup-codes"), alert: message
+        end
+    end
+  end
+end

data/app/controllers/masks/server/client_logos_controller.rb

@@ -0,0 +1,22 @@
+module Masks
+  module Server
+    class ClientLogosController < ApplicationController
+      include ServesPictures
+
+      skip_before_action :refuse_blocked_device, only: :show
+
+      def show
+        client = Client.find_by(client_id: params[:client_id])
+
+        return head :not_found unless client&.logo_shown_to?(current_actor)
+
+        stamped = params[:v] == client.logo_digest && client.approved?
+        caching = stamped ? "public, max-age=#{FOREVER}, immutable" : "private, max-age=#{BRIEFLY}"
+
+        deliver_picture(client.logo_digest, cache_control: caching) do
+          [ Pictures::CONTENT_TYPE, client.logo&.resized(Avatars.size(params[:size])) ]
+        end
+      end
+    end
+  end
+end

data/app/controllers/masks/server/code_factors_controller.rb

@@ -0,0 +1,38 @@
+module Masks
+  module Server
+    class CodeFactorsController < ApplicationController
+      before_action :require_actor
+      before_action -> { reauthenticated!("signing-in", t("code_factors.again")) }
+
+      def create
+        factor = params[:factor].to_s
+
+        return refuse(t("code_factors.unoffered")) unless CodeFactors.offered?(current_actor, factor)
+        return refuse(t("code_factors.unconfirmed")) unless CodeFactors.confirmed?(current_actor, factor)
+        return refuse(t("code_factors.undeliverable")) unless CodeFactors.deliverable?(factor)
+
+        CodeFactors.enable!(current_actor, factor) unless CodeFactors.held?(current_actor, factor)
+
+        redirect_to root_path, notice: t("code_factors.enabled.#{factor}")
+      end
+
+      def destroy
+        factor = params[:factor].to_s
+
+        CodeFactors.disable!(current_actor, factor)
+
+        redirect_to root_path, notice: t("code_factors.disabled.#{factor}")
+      end
+
+      private
+
+        def require_actor
+          redirect_to login_path unless current_actor
+        end
+
+        def refuse(message)
+          redirect_to root_path, alert: message
+        end
+    end
+  end
+end

data/app/controllers/masks/server/connections_controller.rb

@@ -0,0 +1,43 @@
+module Masks
+  module Server
+    class ConnectionsController < ApplicationController
+      before_action :require_actor
+
+      def create
+        provider = Provider.signing_in.find_by(key: params[:provider].to_s)
+
+        location = Linking.start!(
+          session: session,
+          provider: provider,
+          actor: current_actor,
+          authenticated_at: current_session&.authenticated_at
+        )
+
+        redirect_to location, allow_other_host: true
+      rescue Linking::Refused => e
+        redirect_to root_path(anchor: "connections"), alert: e.message
+      end
+
+      def detach
+        connection = Connection.live.find_by(uuid: params[:id], actor_id: current_actor.id)
+
+        return redirect_to root_path, alert: t("connections.unknown") if connection.nil?
+
+        connection.revoke!(reason: "revoked by #{current_actor.identifier}")
+
+        Event.record!(
+          Event::CONNECTION_UNLINKED,
+          actor: current_actor, provider: connection.provider.key
+        )
+
+        redirect_to root_path, notice: t("connections.disconnected", provider: connection.provider.name)
+      end
+
+      private
+
+        def require_actor
+          redirect_to login_path if current_actor.nil?
+        end
+    end
+  end
+end

data/app/controllers/masks/server/delegations_controller.rb

@@ -0,0 +1,24 @@
+module Masks
+  module Server
+    class DelegationsController < ApplicationController
+      before_action :require_actor
+
+      def destroy
+        delegation = Delegation.live.includes(:client, connection: :provider).find_by(uuid: params[:id].to_s, actor_id: current_actor.id)
+
+        return redirect_to root_path(anchor: "connections"), alert: t("delegations.unknown") if delegation.nil?
+
+        delegation.revoke!(reason: "stopped by #{current_actor.identifier}", by: current_actor)
+
+        redirect_to root_path(anchor: "connections"),
+                    notice: t("delegations.stopped", client: delegation.client.name, provider: delegation.connection.provider.name)
+      end
+
+      private
+
+        def require_actor
+          redirect_to login_path if current_actor.nil?
+        end
+    end
+  end
+end

data/app/controllers/masks/server/device_authorizations_controller.rb

@@ -0,0 +1,74 @@
+module Masks
+  module Server
+    class DeviceAuthorizationsController < ApplicationController
+      include RackOAuth2Endpoint
+      include TokenPresented
+
+      rate_limit to: 60, within: 1.minute,
+                 by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
+                 with: -> { slow_down }
+
+      def create
+        client = authenticate_client!
+        authorization = asked
+
+        check!(client, authorization)
+
+        grant = DeviceGrant.open!(authorization)
+
+        Event.record!(Event::DEVICE_CODE_ISSUED, client: client, scopes: grant.scope_list)
+
+        no_store!
+
+        render json: described(grant), status: :ok
+      end
+
+      private
+
+        def asked
+          Authorization.new(
+            client_id: params[:client_id],
+            redirect_uri: nil,
+            response_type: nil,
+            scope: params[:scope],
+            resource: repeated("resource"),
+            organization: params[:organization]
+          )
+        end
+
+        def described(grant)
+          spaced = UserCodes.spaced(grant.user_code)
+
+          {
+            "device_code" => grant.device_code,
+            "user_code" => spaced,
+            "verification_uri" => verification_uri,
+            "verification_uri_complete" => "#{verification_uri}?#{URI.encode_www_form(user_code: spaced)}",
+            "expires_in" => grant.expires_in,
+            "interval" => grant.interval
+          }
+        end
+
+        def verification_uri
+          "#{issuer.url}#{device_verification_path}"
+        end
+
+        def check!(client, authorization)
+          refuse!("client_id is required") if authorization.client_id.blank?
+
+          unless authorization.client_id == client.client_id
+            refuse!("client_id does not match the authenticated client")
+          end
+
+          DevicePolicy.new(authorization).call
+        end
+
+        def slow_down
+          render json: {
+            "error" => "slow_down",
+            "error_description" => "too many device requests from this address"
+          }, status: :too_many_requests
+        end
+    end
+  end
+end

data/app/controllers/masks/server/device_verifications_controller.rb

@@ -0,0 +1,78 @@
+module Masks
+  module Server
+    class DeviceVerificationsController < ApplicationController
+      UNKNOWN = "unknown".freeze
+      DECLINED = "declined".freeze
+
+      before_action :establish_device
+
+      rate_limit to: ::Rails.configuration.masks.device_code_limit, within: 3.minutes,
+                 if: -> { params[:user_code].present? },
+                 by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
+                 with: -> { asking(UNKNOWN, status: :too_many_requests) }
+
+      def show
+        return asking(params[:refused].presence) if params[:user_code].blank?
+
+        grant = DeviceGrant.awaiting(params[:user_code])
+
+        return asking(UNKNOWN) if grant.nil? || grant.answered?
+
+        pending = track_request!(grant.authorization)
+
+        return asking(UNKNOWN) if pending.consumed?
+
+        login = advance(pending)
+
+        return declined(grant, pending) if login.refused?
+        return prompt(login) unless login.settled?
+
+        approve!(grant, pending, login)
+      end
+
+      def create
+        redirect_to device_verification_path(user_code: params[:user_code])
+      end
+
+      private
+
+        def asking(refused = nil, status: :ok)
+          @refused = refused
+
+          render :show, status: status
+        end
+
+        def declined(grant, pending)
+          refuse_device(pending, grant)
+
+          asking(DECLINED)
+        end
+
+        def approve!(grant, pending, login)
+          claimed = PendingRequest.claim(rid_for(pending))
+
+          return asking(UNKNOWN) if claimed.nil?
+
+          settle!(login)
+
+          grant.approve!(
+            actor: current_actor,
+            session: current_session,
+            device: current_device,
+            authenticated_at: login.authenticated_at || current_session&.authenticated_at,
+            amr: login.amr.presence || current_session&.amr,
+            organization: login.state("organization-choice").selected
+          )
+
+          Event.record!(
+            Event::DEVICE_CODE_APPROVED,
+            actor: current_actor, client: grant.client, scopes: grant.scopes_for(current_actor)
+          )
+
+          @client = grant.client
+
+          render :approved
+        end
+    end
+  end
+end

data/app/controllers/masks/server/devices_controller.rb

@@ -0,0 +1,50 @@
+module Masks
+  module Server
+    class DevicesController < ApplicationController
+      before_action :require_actor
+
+      def update
+        return refuse(t("devices.unknown")) if device.nil?
+        return refuse(t("devices.shared")) if device.shared_beyond?(current_actor)
+
+        device.update!(name: params[:name].to_s.strip.presence)
+
+        Event.record!(
+          Event::DEVICE_NAMED,
+          actor: current_actor, device: device, name: device.name
+        )
+
+        redirect_to root_path, notice: t("devices.renamed")
+      end
+
+      def destroy
+        return refuse(t("devices.unknown")) if device.nil?
+
+        device.sign_out!(actor: current_actor)
+
+        Event.record!(Event::DEVICE_FORGOTTEN, actor: current_actor, device: device)
+
+        if device == current_device
+          cookies.delete(:masks_session)
+          return redirect_to login_path, notice: t("devices.signed_out")
+        end
+
+        redirect_to root_path, notice: t("devices.signed_out")
+      end
+
+      private
+
+        def device
+          @device ||= current_actor.devices.find_by(id: params[:id])
+        end
+
+        def require_actor
+          redirect_to login_path unless current_actor
+        end
+
+        def refuse(message)
+          redirect_to root_path, alert: message
+        end
+    end
+  end
+end

data/app/controllers/masks/server/discovery_controller.rb

@@ -0,0 +1,18 @@
+module Masks
+  module Server
+    class DiscoveryController < ApplicationController
+      def openid
+        render json: issuer.discovery
+      end
+
+      def jwks
+        expires_in 5.minutes, public: true
+        render json: issuer.jwks
+      end
+
+      def resource
+        render json: issuer.protected_resource
+      end
+    end
+  end
+end

data/app/controllers/masks/server/forward_auth_controller.rb

@@ -0,0 +1,90 @@
+module Masks
+  module Server
+    class ForwardAuthController < ApplicationController
+      skip_forgery_protection
+      before_action -> { request.session_options[:skip] = true }, only: %i[check callback]
+
+      rate_limit to: 30, within: 1.minute, only: %i[start callback],
+                 by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
+                 with: -> { head :too_many_requests }
+
+      def check
+        target = Forwarded.target(request)
+        return head(:bad_request) if target.nil?
+        return answer_callback(target, params_from(target)["code"]) if target.path == Client::FORWARD_CALLBACK
+
+        client = Client.forwarding_to(target)
+        return head(:forbidden) if client.nil?
+
+        held = ForwardSession.held(cookies[ForwardSession::COOKIE], client)
+        return admit(held.actor) if held
+
+        return head(:unauthorized) if params[:status] == "401"
+
+        redirect_to forward_auth_start_url(rd: target.to_s), allow_other_host: true
+      end
+
+      def start
+        target = URI.parse(return_to)
+        client = Client.forwarding_to(target)
+
+        return render(plain: t("forward_auth.unknown"), status: :not_found) if client.nil?
+        return redirect_to(login_path(return_to: request.fullpath)) if current_actor.nil?
+        return render(plain: t("forward_auth.not_admitted", app: client.name), status: :forbidden) unless client.admits?(current_actor)
+
+        code = ForwardCode.mint!(actor: current_actor, client: client, session: current_session,
+                                 payload: { "return_to" => target.to_s })
+
+        redirect_to "#{client.forward_origin}#{Client::FORWARD_CALLBACK}?code=#{code.secret}", allow_other_host: true
+      rescue URI::InvalidURIError
+        render plain: t("forward_auth.unknown"), status: :not_found
+      end
+
+      def callback
+        target = Forwarded.target(request)
+        return head(:bad_request) if target.nil?
+
+        answer_callback(URI.parse("#{Forwarded.origin(target)}#{Client::FORWARD_CALLBACK}"), params[:code])
+      end
+
+      private
+
+        def answer_callback(target, secret)
+          code = ForwardCode.claim(secret)
+          client = code&.client
+
+          return head(:forbidden) if code.nil? || client.nil? || client.forward_origin != Forwarded.origin(target)
+          return head(:forbidden) unless code.session&.live? && client.admits?(code.actor)
+
+          held = ForwardSession.mint!(actor: code.actor, client: client, session: code.session,
+                                      expires_at: code.session.expires_at)
+
+          cookies[ForwardSession::COOKIE] = {
+            value: held.secret, httponly: true, secure: target.scheme == "https", same_site: :lax, path: "/",
+            expires: held.expires_at
+          }
+
+          redirect_to code.return_to, allow_other_host: true
+        end
+
+        def admit(actor)
+          response.headers["Remote-User"] = actor.nickname.presence || actor.identifier
+          response.headers["Remote-Email"] = actor.email if actor.email_verified_at.present?
+          response.headers["Remote-Name"] = actor.name if actor.name.present?
+          response.headers["Remote-Groups"] = actor.group_labels.join(",")
+
+          head :ok
+        end
+
+        def return_to
+          raw = request.query_string[/(?:\A|&)rd=(.*)\z/m, 1].to_s
+
+          raw.match?(/\Ahttps?%3A/i) ? CGI.unescape(raw) : raw
+        end
+
+        def params_from(target)
+          Rack::Utils.parse_query(target.query.to_s)
+        end
+    end
+  end
+end