masks-server 0.7.0

data/app/models/masks/server/device_grant.rb

@@ -0,0 +1,93 @@
+module Masks
+  module Server
+    class DeviceGrant < Token
+      include CarriesAuthorization
+
+      GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code".freeze
+      INTERVAL = 5
+      ATTEMPTS = 10
+
+      def self.lifetime
+        15.minutes
+      end
+
+      def self.open!(authorization)
+        code = UserCodes.generate
+        held = attributes_for(authorization)
+
+        mint!(
+          **held,
+          payload: held[:payload].merge("user_code" => code),
+          user_code_digest: UserCodes.digest(code)
+        )
+      end
+
+      def self.awaiting(value)
+        code = UserCodes.read(value)
+
+        return nil if code.nil?
+
+        live.find_by(user_code_digest: UserCodes.digest(code))
+      end
+
+      def user_code
+        held("user_code")
+      end
+
+      def device_code
+        secret
+      end
+
+      def interval
+        INTERVAL
+      end
+
+      def approved?
+        actor_id.present?
+      end
+
+      def denied?
+        held("denied").present?
+      end
+
+      def answered?
+        approved? || denied?
+      end
+
+      def approve!(actor:, session: nil, device: nil, authenticated_at: nil, amr: nil, organization: nil)
+        update!(
+          actor: actor,
+          session: session,
+          device: device,
+          organization: organization,
+          authenticated_at: authenticated_at,
+          payload: payload.merge("amr" => Array(amr))
+        )
+      end
+
+      def refuse!(by: nil)
+        update!(payload: payload.merge("denied" => true))
+
+        Event.record!(Event::DEVICE_CODE_REFUSED, actor: by, client: client)
+      end
+
+      def hurried?
+        !::Rails.cache.write("device:#{id}:polled", true, expires_in: INTERVAL, unless_exist: true)
+      end
+
+      def issue!(issuer:, jkt: nil)
+        AccessToken.issue!(
+          issuer: issuer,
+          actor: actor,
+          client: client,
+          scopes: scopes_for(actor),
+          audience: audience.presence || [ client.client_id ],
+          parent: self,
+          requested_claims: requested_claims,
+          authorization_details: authorization_details,
+          jkt: jkt
+        )
+      end
+    end
+  end
+end

data/app/models/masks/server/domain_claim.rb

@@ -0,0 +1,85 @@
+module Masks
+  module Server
+    class DomainClaim < ApplicationRecord
+      class Taken < StandardError; end
+
+      include TenantScoped
+
+      PREFIX = "_masks-challenge".freeze
+      VALUE = "masks-verification=".freeze
+      GRACE = 7.days
+      TIMEOUT = 5
+      HOSTNAME = /\A(?=.{4,253}\z)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}\z/
+
+      belongs_to :provider, optional: true
+
+      scope :verified, -> { where.not(verified_at: nil) }
+
+      normalizes :domain, with: ->(value) { value.to_s.strip.downcase.delete_prefix("@").delete_suffix(".") }
+
+      validates :domain, format: { with: HOSTNAME, message: "is not a domain name" },
+                         uniqueness: { scope: :tenant_id }
+      validate :provider_signs_in
+
+      before_validation(on: :create) { self.token ||= SecureRandom.hex(20) }
+
+      class << self
+        def for_email(email)
+          domain = email.to_s.strip.downcase.split("@", 2).last
+
+          return nil if domain.blank? || !email.to_s.include?("@")
+
+          verified.includes(:provider).find_by(domain: domain)
+        end
+
+        def txt_records(name)
+          Resolv::DNS.open do |dns|
+            dns.timeouts = TIMEOUT
+            dns.getresources(name, Resolv::DNS::Resource::IN::TXT).flat_map(&:strings)
+          end
+        rescue Resolv::ResolvError, SocketError, Timeout::Error
+          []
+        end
+      end
+
+      def record_name
+        "#{PREFIX}.#{domain}"
+      end
+
+      def record_value
+        "#{VALUE}#{token}"
+      end
+
+      def verified?
+        verified_at.present?
+      end
+
+      def check!(now: Time.current)
+        found = self.class.txt_records(record_name).any? { |value| ActiveSupport::SecurityUtils.secure_compare(value.strip, record_value) }
+
+        if found
+          assign_attributes(verified_at: verified_at || now, missing_since: nil)
+        elsif verified?
+          self.missing_since ||= now
+          assign_attributes(verified_at: nil, missing_since: nil) if missing_since <= now - GRACE
+        end
+
+        self.checked_at = now
+        save!
+        found
+      rescue ActiveRecord::RecordNotUnique
+        raise Taken, "#{domain} is already proven by another tenant"
+      end
+
+      def discovers
+        provider if verified? && provider&.signs_in? && provider.archived_at.nil?
+      end
+
+      private
+
+        def provider_signs_in
+          errors.add(:provider, "cannot sign anybody in") if provider && !provider.signs_in?
+        end
+    end
+  end
+end

data/app/models/masks/server/email_verification.rb

@@ -0,0 +1,22 @@
+module Masks
+  module Server
+    class EmailVerification < Token
+      include MailedLink
+
+      path "verify"
+
+      def self.lifetime
+        ::Rails.configuration.masks.email_verification_lifetime
+      end
+
+      def self.settle!(secret)
+        claimed = claim(secret)
+        return nil if claimed.nil?
+        return nil unless claimed.addressed?
+
+        claimed.actor.update!(email_verified_at: Time.current)
+        claimed.actor
+      end
+    end
+  end
+end

data/app/models/masks/server/event.rb

@@ -0,0 +1,251 @@
+module Masks
+  module Server
+    class Event < ApplicationRecord
+      include TenantScoped
+
+      RETENTION = 180.days
+      LIMIT = 50
+      CEILING = 250
+      AGENT_LIMIT = 500
+
+      SESSION_STARTED = "session.started".freeze
+      SESSION_ENDED = "session.ended".freeze
+      SESSION_REVOKED = "session.revoked".freeze
+      SESSION_EXPIRED = "session.expired".freeze
+      LOGOUT_UNDELIVERED = "logout.undelivered".freeze
+      LOGIN_REFUSED = "login.refused".freeze
+      LOGIN_THROTTLED = "login.throttled".freeze
+
+      ACCOUNT_CREATED = "account.created".freeze
+      ACCOUNT_EXPORTED = "account.exported".freeze
+      INVITATION_SENT = "invitation.sent".freeze
+      INVITATION_ACCEPTED = "invitation.accepted".freeze
+
+      PASSWORD_CHANGED = "password.changed".freeze
+      PASSWORD_RESET_REQUESTED = "password.reset_requested".freeze
+      PASSWORD_RESET_COMPLETED = "password.reset_completed".freeze
+
+      EMAIL_VERIFICATION_SENT = "email.verification_sent".freeze
+      EMAIL_VERIFIED = "email.verified".freeze
+      PHONE_VERIFICATION_SENT = "phone.verification_sent".freeze
+      PHONE_VERIFIED = "phone.verified".freeze
+      EMAIL_CHANGED = "email.changed".freeze
+      PHONE_CHANGED = "phone.changed".freeze
+      PHONE_REMOVED = "phone.removed".freeze
+      APPROVAL_REQUESTED = "approval.requested".freeze
+      ACTOR_APPROVED = "actor.approved".freeze
+
+      PASSKEY_ADDED = "passkey.added".freeze
+      PASSKEY_REMOVED = "passkey.removed".freeze
+      PASSKEY_RENAMED = "passkey.renamed".freeze
+      BACKUP_CODES_GENERATED = "backup_codes.generated".freeze
+      BACKUP_CODE_SPENT = "backup_code.spent".freeze
+      AUTHENTICATOR_ENABLED = "authenticator.enabled".freeze
+      AUTHENTICATOR_DISABLED = "authenticator.disabled".freeze
+      EMAIL_CODES_ENABLED = "email_codes.enabled".freeze
+      EMAIL_CODES_DISABLED = "email_codes.disabled".freeze
+      TEXT_CODES_ENABLED = "text_codes.enabled".freeze
+      TEXT_CODES_DISABLED = "text_codes.disabled".freeze
+      RECOVERY_REQUESTED = "recovery.requested".freeze
+      RECOVERY_DISMISSED = "recovery.dismissed".freeze
+      SECOND_FACTORS_RESET = "second_factors.reset".freeze
+      GROUP_CREATED = "group.created".freeze
+      GROUP_DELETED = "group.deleted".freeze
+      GROUP_JOINED = "group.member_added".freeze
+      GROUP_LEFT = "group.member_removed".freeze
+
+      DEVICE_CODE_ISSUED = "device_code.issued".freeze
+      DEVICE_CODE_APPROVED = "device_code.approved".freeze
+      DEVICE_CODE_REFUSED = "device_code.refused".freeze
+
+      DEVICE_TRUSTED = "device.trusted".freeze
+      SIGN_IN_APPROVED = "sign_in.approved".freeze
+      SIGN_IN_DENIED = "sign_in.denied".freeze
+      SIGN_IN_RISKY = "sign_in.risky".freeze
+      DEVICE_NAMED = "device.named".freeze
+      DEVICE_FORGOTTEN = "device.forgotten".freeze
+      DEVICE_BLOCKED = "device.blocked".freeze
+      DEVICE_UNBLOCKED = "device.unblocked".freeze
+
+      AVATAR_UPLOADED = "avatar.uploaded".freeze
+      AVATAR_REMOVED = "avatar.removed".freeze
+
+      CONSENT_GRANTED = "consent.granted".freeze
+      CONSENT_REVOKED = "consent.revoked".freeze
+      CONNECTION_LINKED = "connection.linked".freeze
+      CONNECTION_UNLINKED = "connection.unlinked".freeze
+      CONNECTION_SIGNED_IN = "connection.signed_in".freeze
+      CONNECTION_REFUSED = "connection.refused".freeze
+      DELEGATION_GRANTED = "delegation.granted".freeze
+      DELEGATION_RELEASED = "delegation.released".freeze
+      DELEGATION_REFUSED = "delegation.refused".freeze
+      DELEGATION_REVOKED = "delegation.revoked".freeze
+      EXCHANGE_GRANTED = "exchange.granted".freeze
+      EXCHANGE_REFUSED = "exchange.refused".freeze
+
+      ACTOR_CREATED = "actor.created".freeze
+      ACTOR_PROVISIONED = "actor.provisioned".freeze
+      ACTOR_UPDATED = "actor.updated".freeze
+      ACTOR_DELETED = "actor.deleted".freeze
+      ACTOR_SCOPES_CHANGED = "actor.scopes_changed".freeze
+      ACTOR_SIGNED_OUT = "actor.signed_out".freeze
+      ACTOR_SUSPENDED = "actor.suspended".freeze
+      ACTOR_RESTORED = "actor.restored".freeze
+      ACTOR_IDLE_WARNED = "actor.idle_warned".freeze
+      PROVISIONING_TOKEN_ISSUED = "provisioning_token.issued".freeze
+      PROVISIONING_TOKEN_REVOKED = "provisioning_token.revoked".freeze
+      LDAP_CREDENTIAL_ISSUED = "ldap_credential.issued".freeze
+      LDAP_CREDENTIAL_REVOKED = "ldap_credential.revoked".freeze
+      LDAP_BOUND = "ldap.bound".freeze
+
+      CLIENT_CREATED = "client.created".freeze
+      CLIENT_REGISTERED = "client.registered".freeze
+      CLIENT_APPROVED = "client.approved".freeze
+      CLIENT_UPDATED = "client.updated".freeze
+      CLIENT_ARCHIVED = "client.archived".freeze
+      CLIENT_RESTORED = "client.restored".freeze
+      CLIENT_SECRET_ROTATED = "client.secret_rotated".freeze
+      CLIENT_LOGO_REFUSED = "client.logo_refused".freeze
+
+      TOKEN_REVOKED = "token.revoked".freeze
+      SAML_ASSERTED = "saml.asserted".freeze
+      REFRESH_REUSED = "refresh.reused".freeze
+
+      SIGNING_KEY_STAGED = "signing_key.staged".freeze
+      SIGNING_KEY_ROTATED = "signing_key.rotated".freeze
+      SIGNING_KEY_ACTIVATED = "signing_key.activated".freeze
+      SIGNING_KEY_DISCARDED = "signing_key.discarded".freeze
+
+      NAMESPACE_RELEASED = "namespace.released".freeze
+      PROVIDER_CREATED = "provider.created".freeze
+      PROVIDER_UPDATED = "provider.updated".freeze
+      PROVIDER_ARCHIVED = "provider.archived".freeze
+      TENANT_UPDATED = "tenant.updated".freeze
+      SIGN_IN_POLICY_CREATED = "sign_in_policy.created".freeze
+      SIGN_IN_POLICY_UPDATED = "sign_in_policy.updated".freeze
+      SIGN_IN_POLICY_ARCHIVED = "sign_in_policy.archived".freeze
+      SENDER_CREATED = "sender.created".freeze
+      SENDER_UPDATED = "sender.updated".freeze
+      SENDER_ARCHIVED = "sender.archived".freeze
+      SENDER_TESTED = "sender.tested".freeze
+      EVENTS_EXPORTED = "events.exported".freeze
+
+      STREAM_CREATED = "stream.created".freeze
+      STREAM_UPDATED = "stream.updated".freeze
+      MAIL_TEMPLATE_UPDATED = "mail_template.updated".freeze
+      STREAM_ARCHIVED = "stream.archived".freeze
+      STREAM_SECRET_ROTATED = "stream.secret_rotated".freeze
+      STREAM_TESTED = "stream.tested".freeze
+      STREAM_FAILED = "stream.failed".freeze
+
+      SIGNAL_STREAM_CREATED = "signal_stream.created".freeze
+      SIGNAL_STREAM_UPDATED = "signal_stream.updated".freeze
+      SIGNAL_STREAM_DELETED = "signal_stream.deleted".freeze
+      SIGNAL_UNDELIVERED = "signal.undelivered".freeze
+      SIGNAL_RECEIVED = "signal.received".freeze
+
+      ORGANIZATION_CREATED = "organization.created".freeze
+      ORGANIZATION_UPDATED = "organization.updated".freeze
+      ORGANIZATION_ARCHIVED = "organization.archived".freeze
+      MEMBERSHIP_ADDED = "membership.added".freeze
+      MEMBERSHIP_ROLE_CHANGED = "membership.role_changed".freeze
+      MEMBERSHIP_REMOVED = "membership.removed".freeze
+      MEMBERSHIP_ACCEPTED = "membership.accepted".freeze
+      MEMBERSHIP_ROLE_KEPT = "membership.role_kept".freeze
+      MEMBERSHIP_SUSPENDED = "membership.suspended".freeze
+      ORGANIZATION_OWNERLESS = "organization.ownerless".freeze
+      MEMBERSHIP_RESENT = "membership.resent".freeze
+      MEMBERSHIP_EXPIRED = "membership.expired".freeze
+
+      DOMAIN_CLAIMED = "domain.claimed".freeze
+      DOMAIN_VERIFIED = "domain.verified".freeze
+      DOMAIN_RELEASED = "domain.released".freeze
+      CUSTOM_DOMAIN_SERVED = "custom_domain.served".freeze
+      CUSTOM_DOMAIN_STOPPED = "custom_domain.stopped".freeze
+
+      GRAVE = [
+        LOGIN_REFUSED, LOGIN_THROTTLED, LOGOUT_UNDELIVERED, REFRESH_REUSED, STREAM_FAILED,
+        DEVICE_BLOCKED, ACTOR_DELETED, AUTHENTICATOR_DISABLED, CONNECTION_REFUSED, DELEGATION_REFUSED,
+        EXCHANGE_REFUSED, SIGN_IN_RISKY, SIGNAL_UNDELIVERED, SIGNAL_RECEIVED, MEMBERSHIP_ROLE_KEPT, ORGANIZATION_OWNERLESS
+      ].freeze
+
+      ACTIONS = constants(false).filter_map do |name|
+        value = const_get(name)
+        value if value.is_a?(String) && value.include?(".")
+      end.freeze
+
+      belongs_to :actor, optional: true
+      belongs_to :by, class_name: "Actor", optional: true
+      belongs_to :client, optional: true
+      belongs_to :device, optional: true
+      belongs_to :organization, optional: true
+
+      validates :action, inclusion: { in: ACTIONS }
+
+      include Paged
+
+      after_create_commit :raise_notification
+
+      class << self
+        def record!(action, actor: nil, by: :subject, client: nil, device: :ambient,
+                    ip_address: :ambient, user_agent: :ambient, organization: :ambient, **details)
+          create!(
+            action: action,
+            actor: actor,
+            by: by == :subject ? actor : by,
+            client: client,
+            organization: organization_for(organization),
+            device: device == :ambient ? Current.device : device,
+            ip_address: ip_address == :ambient ? Current.ip_address : ip_address,
+            user_agent: clip(user_agent == :ambient ? Current.user_agent : user_agent),
+            details: details.compact.deep_stringify_keys
+          )
+        end
+
+        def organization_for(held)
+          case held
+          when :ambient then Current.organization
+          when Organization, nil then held
+          else Organization.find_by(key: held.to_s)
+          end
+        end
+
+        def clip(value)
+          value.presence && value.to_s.truncate(AGENT_LIMIT)
+        end
+
+        def bounded(limit)
+          [ limit.presence&.to_i || LIMIT, CEILING ].min
+        end
+      end
+
+      def exported(tenant = self.tenant)
+        {
+          id: id,
+          tenant: tenant.subdomain,
+          action: action,
+          created_at: created_at.utc.iso8601(3),
+          actor: actor&.uuid,
+          by: by&.uuid,
+          client: client&.client_id,
+          organization: organization&.key,
+          ip_address: ip_address,
+          user_agent: user_agent,
+          details: details
+        }
+      end
+
+      def readonly?
+        persisted?
+      end
+
+      private
+
+        def raise_notification
+          Notifications.raised(self)
+          EventStream.raised(self)
+          SignalStream.raised(self)
+        end
+    end
+  end
+end

data/app/models/masks/server/event_export.rb

@@ -0,0 +1,73 @@
+module Masks
+  module Server
+    class EventExport
+      class Refused < StandardError; end
+
+      LIFETIME = 10.minutes
+      LONGEST = 366.days
+      CEILING = 250_000
+      PURPOSE = "events/export".freeze
+      FILTERS = %w[action organization actor].freeze
+
+      attr_reader :from, :to, :filters
+
+      class << self
+        def verifier
+          Server.message_verifier(PURPOSE)
+        end
+
+        def open(secret, tenant:)
+          held = verifier.verified(secret.to_s, purpose: tenant.uuid)
+
+          return nil unless held.is_a?(Hash)
+
+          new(from: Time.zone.parse(held["from"]), to: Time.zone.parse(held["to"]), by: held["by"],
+              filters: held["filters"] || {})
+        end
+      end
+
+      def initialize(from:, to:, by:, filters: {})
+        @from = from
+        @to = to
+        @by = by
+        @filters = filters.to_h.stringify_keys.slice(*FILTERS).compact_blank
+      end
+
+      def validate!
+        raise Refused, "from must come before to" if from.nil? || to.nil? || from >= to
+        raise Refused, "an export covers at most #{LONGEST.in_days.round} days" if to - from > LONGEST
+        raise Refused, "that range holds more than #{CEILING} events; narrow it" if scope.count > CEILING
+
+        self
+      end
+
+      def secret(tenant)
+        self.class.verifier.generate(
+          { "from" => from.iso8601, "to" => to.iso8601, "by" => @by, "filters" => filters },
+          expires_in: LIFETIME, purpose: tenant.uuid
+        )
+      end
+
+      def exporter
+        Actor.find_by(uuid: @by)
+      end
+
+      def scope
+        held = Event.where(created_at: from...to)
+        held = held.where(action: filters["action"]) if filters["action"]
+        held = held.where(organization: Organization.find_by(key: filters["organization"])) if filters["organization"]
+        held = held.where(actor: Actor.find_by(uuid: filters["actor"])) if filters["actor"]
+        held
+      end
+
+      def lines(tenant)
+        scope.includes(:actor, :by, :client, :organization).order(:created_at, :id).find_each(batch_size: 1_000)
+             .map { |event| "#{event.exported(tenant).to_json}\n" }
+      end
+
+      def filename(tenant)
+        "#{tenant.subdomain}-events-#{from.to_date.iso8601}-#{to.to_date.iso8601}.ndjson"
+      end
+    end
+  end
+end

data/app/models/masks/server/event_stream.rb

@@ -0,0 +1,131 @@
+module Masks
+  module Server
+    class EventStream < ApplicationRecord
+      class Refused < StandardError; end
+
+      include TenantScoped
+      include Archivable
+
+      TOLERANCE = 5.minutes
+      ATTEMPTS = 8
+      UNSTREAMED = [ Event::STREAM_FAILED ].freeze
+
+      belongs_to :organization, optional: true
+
+      encrypts :secret
+
+      validates :key, presence: true,
+                      uniqueness: { scope: :tenant_id },
+                      format: { with: /\A[a-z0-9][a-z0-9-]*\z/ }
+      validates :name, presence: true
+      validate :url_is_callable
+      validate :actions_are_known
+
+      before_validation :issue_secret, on: :create
+      before_validation { self.actions = Array(actions).map(&:to_s).uniq.sort }
+
+      class << self
+        def raised(event)
+          return false if UNSTREAMED.include?(event.action)
+
+          streams = active.select { |stream| stream.streams?(event) }
+
+          streams.each { |stream| EventStreamJob.perform_later(stream.id, event.id) }
+
+          streams.any?
+        end
+
+        def sign(secret, timestamp, body)
+          OpenSSL::HMAC.hexdigest("SHA256", secret, "#{timestamp}.#{body}")
+        end
+
+        def verified?(secret, header, body, now: Time.current)
+          parts = header.to_s.split(",").filter_map { |part| part.split("=", 2).then { |k, v| [ k, v ] if v } }.to_h
+          timestamp = parts["t"]
+
+          return false unless timestamp&.match?(/\A\d+\z/) && parts["v1"]
+          return false if (now.to_i - timestamp.to_i).abs > TOLERANCE
+
+          ActiveSupport::SecurityUtils.secure_compare(parts["v1"], sign(secret, timestamp, body))
+        end
+      end
+
+      def streams?(event)
+        return false if organization_id && event.organization_id != organization_id
+
+        actions.empty? || actions.include?(event.action)
+      end
+
+      def rotate_secret!
+        update!(secret: SecureRandom.hex(32))
+      end
+
+      def deliver!(event)
+        post!(payload(event), action: event.action, delivery: event.id)
+      end
+
+      def ping!
+        post!({ id: nil, tenant: tenant.subdomain, action: "stream.tested", created_at: Time.current.iso8601 },
+              action: "stream.tested", delivery: nil)
+      end
+
+      def delivered!
+        update_columns(last_delivered_at: Time.current, last_failure: nil)
+      end
+
+      def failed!(message)
+        update_columns(last_failure: message.to_s.truncate(255))
+      end
+
+      def payload(event)
+        event.exported(tenant)
+      end
+
+      private
+
+        def post!(body, action:, delivery:)
+          uri = URI.parse(url)
+          json = body.to_json
+          timestamp = Time.current.to_i
+
+          response = Outbound.post_json(
+            uri, json,
+            headers: {
+              "Masks-Event" => action,
+              "Masks-Delivery" => delivery.to_s,
+              "Masks-Signature" => "t=#{timestamp},v1=#{self.class.sign(secret, timestamp, json)}"
+            },
+            address: routable!(uri)
+          )
+
+          return true if response.is_a?(Net::HTTPSuccess)
+
+          raise Refused, "#{name} answered #{response.code}"
+        rescue *Outbound::UNREADABLE, URI::InvalidURIError => e
+          raise Refused, "#{name} could not be reached: #{e.class}"
+        end
+
+        def routable!(uri)
+          return if ::Rails.env.local?
+
+          Outbound.vetted(uri) || raise(Refused, "#{name} resolves to an address this server will not call")
+        end
+
+        def issue_secret
+          self.secret ||= SecureRandom.hex(32)
+        end
+
+        def url_is_callable
+          problem = Outbound.problem_with(url)
+
+          errors.add(:url, problem) if problem
+        end
+
+        def actions_are_known
+          unknown = actions - Event::ACTIONS
+
+          errors.add(:actions, "include unknown actions: #{unknown.join(', ')}") if unknown.any?
+        end
+    end
+  end
+end