masks-server 0.7.0

data/app/models/masks/server/exchange.rb

@@ -0,0 +1,240 @@
+module Masks
+  module Server
+    class Exchange
+      GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange".freeze
+      ACCESS_TOKEN = PresentedToken::ACCESS_TOKEN
+      ID_TOKEN = PresentedToken::ID_TOKEN
+      UPSTREAM_ACCESS_TOKEN = "urn:masks:params:oauth:token-type:upstream_access_token".freeze
+      TOKEN_TYPES = PresentedToken::TYPES
+      REQUESTED_TOKEN_TYPES = [ ACCESS_TOKEN, UPSTREAM_ACCESS_TOKEN ].freeze
+
+      attr_reader :client, :issuer, :proof, :subject_token, :subject_token_type, :actor_token, :actor_token_type,
+                  :requested_token_type, :requested_scopes, :requested_audience,
+                  :requested_lifetime, :named_audience
+
+      def initialize(client:, issuer:, subject_token:, subject_token_type: nil, actor_token: nil, actor_token_type: nil,
+                     requested_token_type: nil, scope: nil, resource: nil, lifetime: nil, audience: nil,
+                     authorization_details: nil, proof: nil)
+        @client = client
+        @proof = proof
+        @authorization_details_value = authorization_details.presence
+        @issuer = issuer
+        @subject_token = subject_token
+        @subject_token_type = subject_token_type.to_s
+        @actor_token = actor_token.presence
+        @actor_token_type = actor_token_type.to_s.presence
+        @requested_token_type = (requested_token_type.presence || ACCESS_TOKEN).to_s
+        @requested_scopes = Scopes.list(scope)
+        @requested_audience = Array(resource).map(&:to_s).reject(&:empty?).uniq
+        @requested_lifetime = lifetime.to_i if lifetime.present?
+        @named_audience = Array(audience).map(&:to_s).reject(&:empty?).uniq
+      end
+
+      def upstream?
+        requested_token_type == UPSTREAM_ACCESS_TOKEN
+      end
+
+      def subject
+        return @subject if defined?(@subject)
+
+        @subject = PresentedToken.read(subject_token, type: subject_token_type, issuer: issuer)
+      end
+
+      def acting
+        return @acting if defined?(@acting)
+
+        @acting = actor_token && PresentedToken.read(actor_token, type: actor_token_type, issuer: issuer)
+      end
+
+      def subject_access_token
+        subject&.record
+      end
+
+      def actor
+        subject&.actor
+      end
+
+      def connection
+        return @connection if defined?(@connection)
+
+        id = named_audience.one? ? named_audience.first : nil
+
+        @connection = id&.match?(Subjects::UUID) ? Connection.includes(:provider).find_by(uuid: id) : nil
+      end
+
+      def delegation
+        return @delegation if defined?(@delegation)
+
+        @delegation = Delegation.covering(client: client, actor: actor, connection: connection)&.tap do |held|
+          held.association(:connection).target = connection
+        end
+      end
+
+      def release!
+        upstream = delegation.release!
+
+        {
+          "access_token" => upstream["access_token"],
+          "issued_token_type" => UPSTREAM_ACCESS_TOKEN,
+          "token_type" => "Bearer",
+          "expires_in" => [ (upstream["expires_at"] - Time.current).to_i, 0 ].max,
+          "scope" => upstream["scope"].to_s
+        }
+      rescue Delegation::Refused => e
+        Event.record!(Event::DELEGATION_REFUSED, actor: actor, by: nil, client: client,
+                                                 provider: connection.provider.key, connection: connection.uuid, reason: e.message)
+
+        raise Policy::Denied.new("invalid_grant", e.message)
+      rescue Delegation::Unavailable => e
+        raise Policy::Denied.new("temporarily_unavailable", e.message, status: :service_unavailable)
+      end
+
+      def consent
+        return @consent if defined?(@consent)
+
+        @consent = actor && Consent.live.find_by(actor: actor, client: client)
+      end
+
+      def consented_scopes
+        held = consent ? Scopes.union(consent.scopes, client.required_scopes) : client.required_scopes
+        held = client.scope_list if client.approved? && !client.consent_required?
+
+        actor ? Scopes.list(actor.permitted_scopes(held)) : []
+      end
+
+      def consented_audience
+        Scopes.list((consent&.audience || []) + (client.approved? ? client.resources : []) + [ client.client_id ])
+      end
+
+      def available_scopes
+        subject.id_token? ? consented_scopes : subject.scope_list
+      end
+
+      def available_audience
+        subject.id_token? ? consented_audience : subject.audience
+      end
+
+      def granted_scopes
+        return Scopes.granted(available_scopes, client.scope_list) if requested_scopes.empty? && subject.access_token?
+        return requested_scopes if requested_scopes.any?
+
+        Scopes.concrete(available_scopes)
+      end
+
+      def unproven
+        [ subject, acting ].compact.find { |presented| presented.record&.bound? && !presented.record.bound_to?(proof) }
+      end
+
+      def requested_authorization_details
+        return @requested_authorization_details if defined?(@requested_authorization_details)
+
+        @requested_authorization_details = AuthorizationDetails.parse(@authorization_details_value)
+      end
+
+      def available_authorization_details
+        subject.access_token? ? subject_access_token&.authorization_details : nil
+      end
+
+      def granted_authorization_details
+        requested_authorization_details&.as_json || available_authorization_details
+      end
+
+      def granted_audience
+        return requested_audience if requested_audience.any?
+        return subject.audience if subject.access_token?
+
+        (client.resources if client.approved?).presence || [ client.client_id ]
+      end
+
+      def expires_at
+        ceiling = subject.expires_at
+        return ceiling if requested_lifetime.nil?
+
+        [ requested_lifetime.seconds.from_now, ceiling ].min
+      end
+
+      def actor_claim
+        return nil if subject.id_token? && acting.nil?
+
+        held = acting ? { "sub" => acting.subject, "client_id" => acting.client_id } : { "sub" => client.client_id }
+        chain = subject.act
+
+        held.merge("act" => chain).compact
+      end
+
+      def validate!
+        ExchangePolicy.new(self).call
+        self
+      end
+
+      def perform!(jkt: nil)
+        Current.organization = subject_access_token&.organization
+
+        validate!
+
+        answer = upstream? ? release! : yield(issue!(jkt: jkt)).merge("issued_token_type" => ACCESS_TOKEN)
+
+        granted!
+
+        answer
+      rescue Policy::Denied => denial
+        refused!(denial)
+
+        raise
+      end
+
+      def granted!
+        Event.record!(
+          Event::EXCHANGE_GRANTED,
+          actor: actor, by: nil, client: client,
+          subject_token_type: subject_token_type,
+          requested_token_type: requested_token_type,
+          scopes: (Scopes.join(granted_scopes) unless upstream?),
+          audience: (granted_audience.presence unless upstream?),
+          authorization_details: (granted_authorization_details&.map { |entry| entry["type"] } unless upstream?),
+          connection: (connection&.uuid if upstream?),
+          acting: actor_claim&.fetch("sub", nil),
+          depth: depth
+        )
+      end
+
+      def refused!(denial)
+        Event.record!(
+          Event::EXCHANGE_REFUSED,
+          actor: actor, by: nil, client: client,
+          subject_token_type: subject_token_type.presence,
+          requested_token_type: requested_token_type,
+          error: denial.error,
+          said: denial.description
+        )
+      end
+
+      def depth
+        chain = actor_claim
+        count = 0
+
+        while chain.is_a?(Hash)
+          count += 1
+          chain = chain["act"]
+        end
+
+        count
+      end
+
+      def issue!(jkt: nil)
+        AccessToken.issue!(
+          issuer: issuer,
+          actor: actor,
+          client: client,
+          scopes: granted_scopes,
+          audience: granted_audience,
+          parent: subject_access_token,
+          expires_at: expires_at,
+          act: actor_claim,
+          jkt: jkt,
+          authorization_details: granted_authorization_details
+        )
+      end
+    end
+  end
+end

data/app/models/masks/server/federation/mcp.rb

@@ -0,0 +1,29 @@
+module Masks
+  module Server
+    module Federation
+      class Mcp < Protocol
+        private
+
+          def identify(tokens, _handoff, _params)
+            raise Provider::Untrusted, "#{provider.name} returned no access token" if tokens["access_token"].blank?
+
+            return tokens if provider.userinfo_url.blank?
+
+            tokens.merge(provider.get(provider.userinfo_url, tokens["access_token"]))
+          end
+
+          def anonymous?
+            true
+          end
+
+          def scopes
+            provider.scope_list
+          end
+
+          def delegation_extra
+            super.merge("resource" => provider.resource_url)
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/federation/oauth2.rb

@@ -0,0 +1,27 @@
+module Masks
+  module Server
+    module Federation
+      class OAuth2 < Protocol
+        private
+
+          def identify(tokens, _handoff, _params)
+            raise Provider::Untrusted, "#{provider.name} returned no access token" if tokens["access_token"].blank?
+
+            provider.get(provider.userinfo_url, tokens["access_token"])
+          end
+
+          def supplement(tokens)
+            return {} if provider.emails_url.blank?
+
+            listed = provider.get_list(provider.emails_url, tokens["access_token"])
+            chosen = listed.find { |one| one["primary"] && one["verified"] == true } ||
+              listed.find { |one| one["verified"] == true }
+
+            chosen ? { "email" => chosen["email"].to_s, "email_verified" => true } : { "email" => nil, "email_verified" => nil }
+          rescue Provider::Refused
+            { "email" => nil, "email_verified" => nil }
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/federation/oidc.rb

@@ -0,0 +1,146 @@
+module Masks
+  module Server
+    module Federation
+      class Oidc < Protocol
+        SKEW = 60
+        JWKS_INTERVAL = 5.minutes
+        ALGORITHMS = %w[RS256 RS384 RS512 ES256 ES384 ES512 PS256 PS384 PS512].freeze
+        NAMED = %w[given_name family_name].freeze
+
+        def refresh_keys!
+          endpoint = provider.jwks_uri.presence || Provider.discover(provider.issuer)["jwks_uri"]
+
+          raise Provider::Untrusted, "#{provider.name} publishes no jwks_uri" if endpoint.blank?
+
+          fetched = provider.get(endpoint)
+
+          raise Provider::Untrusted, "#{provider.name} published no keys" unless fetched["keys"].is_a?(Array) && fetched["keys"].any?
+
+          provider.update!(jwks: fetched, jwks_uri: endpoint, jwks_fetched_at: Time.current)
+
+          fetched
+        end
+
+        def verify_signed(token)
+            keys = held_keys
+            keys = refresh_keys! if stale_keys?(keys, peek(token)["kid"])
+
+            JWT.decode(token, nil, true, algorithms: ALGORITHMS, jwks: JWT::JWK::Set.new(keys),
+                                         iat_leeway: SKEW, exp_leeway: SKEW, nbf_leeway: SKEW)
+          rescue JWT::DecodeError => e
+            raise Provider::Untrusted, "#{provider.name} signed that token with a key this server could not verify (#{e.class})"
+          end
+
+        private
+
+          def extra_handoff
+            { "nonce" => SecureRandom.urlsafe_base64(STATE_BYTES) }
+          end
+
+          def scopes
+            Scopes.union(provider.form_post? ? %w[openid] : %w[openid email profile], provider.scope_list)
+          end
+
+          def identify(tokens, handoff, params)
+            raise Provider::Untrusted, "#{provider.name} returned no id_token" if tokens["id_token"].blank?
+
+            claims = verify(tokens["id_token"])
+
+            unless claims["iss"].to_s.chomp("/") == provider.issuer
+              raise Provider::Untrusted, "#{provider.name} answered for #{claims['iss']}, not #{provider.issuer}"
+            end
+
+            raise Provider::Untrusted, "#{provider.name} issued that token to another application" unless audience_holds?(claims)
+            raise Provider::Untrusted, "#{provider.name} returned a token for a different sign-in" unless handoff["nonce"].present? && claims["nonce"] == handoff["nonce"]
+            raise Provider::Untrusted, "#{provider.name} returned no subject" if claims["sub"].blank?
+
+            named(fill(claims, tokens), params)
+          end
+
+          def audience_holds?(claims)
+            audience = Array(claims["aud"])
+
+            return false unless audience.include?(provider.client_id)
+            return true if audience.length == 1
+
+            claims["azp"].present? ? claims["azp"] == provider.client_id : false
+          end
+
+          def fill(claims, tokens)
+            return claims if provider.userinfo_url.blank? || claims["email"].present?
+
+            profile = provider.get(provider.userinfo_url, tokens["access_token"]).except("iss", "aud", "exp", "iat", "nonce")
+
+            return claims unless profile["sub"].present? && profile["sub"] == claims["sub"]
+
+            profile.merge(claims)
+          rescue Provider::Refused, Provider::Unreachable
+            claims
+          end
+
+          def named(claims, params)
+            user = JSON.parse(params["user"].to_s)
+            name = user.is_a?(Hash) ? user["name"] : nil
+
+            return claims unless name.is_a?(Hash)
+
+            given = name["firstName"].to_s.strip.presence
+            family = name["lastName"].to_s.strip.presence
+
+            claims.reverse_merge(
+              "given_name" => given,
+              "family_name" => family,
+              "name" => [ given, family ].compact.join(" ").presence
+            ).compact
+          rescue JSON::ParserError
+            claims
+          end
+
+          def verify(id_token)
+            keys = held_keys
+            kid = peek(id_token)["kid"]
+
+            keys = refresh_keys! if stale_keys?(keys, kid)
+
+            decode(id_token, keys)
+          rescue JWT::VerificationError, JWT::DecodeError => e
+            raise Provider::Untrusted, "#{provider.name} signed that token with a key this server could not verify (#{e.class})"
+          end
+
+          def decode(id_token, keys)
+            JWT.decode(
+              id_token, nil, true,
+              algorithms: ALGORITHMS,
+              jwks: JWT::JWK::Set.new(keys),
+              verify_expiration: true,
+              verify_iat: true,
+              exp_leeway: SKEW,
+              iat_leeway: SKEW,
+              nbf_leeway: SKEW
+            ).first
+          end
+
+          def held_keys
+            held = provider.jwks.is_a?(Hash) ? provider.jwks : {}
+
+            held["keys"].is_a?(Array) ? held : { "keys" => [] }
+          end
+
+          def stale_keys?(keys, kid)
+            return false if provider.jwks_fetched_at.present? && provider.jwks_fetched_at > JWKS_INTERVAL.ago && keys["keys"].any?
+            return true if keys["keys"].empty?
+
+            kid.blank? || keys["keys"].none? { |key| key["kid"] == kid }
+          end
+
+          def peek(id_token)
+            header = id_token.to_s.split(".").first
+
+            JSON.parse(Base64.urlsafe_decode64(header.to_s + "=" * ((4 - header.to_s.length % 4) % 4)))
+          rescue ArgumentError, JSON::ParserError
+            {}
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/federation/protocol.rb

@@ -0,0 +1,114 @@
+module Masks
+  module Server
+    module Federation
+      class Protocol
+        STATE_BYTES = 32
+        VERIFIER_BYTES = 64
+
+        attr_reader :provider, :tokens
+
+        def initialize(provider)
+          @provider = provider
+        end
+
+        def start(callback:, delegated: false)
+          handoff = {
+            "state" => SecureRandom.urlsafe_base64(STATE_BYTES),
+            "verifier" => SecureRandom.urlsafe_base64(VERIFIER_BYTES),
+            "delegated" => delegated
+          }.merge(extra_handoff)
+
+          [ authorize_url(callback, handoff), handoff ]
+        end
+
+        def finish(params, handoff:, callback:)
+          unless params["state"].present? &&
+                 ActiveSupport::SecurityUtils.secure_compare(params["state"].to_s, handoff["state"].to_s)
+            raise Provider::Untrusted, "the state did not match this browser"
+          end
+
+          raise Provider::Refused, upstream_error(params) if params["error"].present?
+          raise Provider::Refused, "#{provider.name} returned no code" if params["code"].blank?
+
+          @tokens = provider.redeem!(code: params["code"].to_s, redirect_uri: callback, verifier: handoff["verifier"])
+
+          identity = normalize(identify(tokens, handoff, params)).merge(supplement(tokens)).compact
+
+          raise Provider::Untrusted, "#{provider.name} returned no #{provider.subject_claim} to identify the account by" if identity["sub"].blank? && !anonymous?
+
+          identity
+        end
+
+        private
+
+          def extra_handoff
+            {}
+          end
+
+          def anonymous?
+            false
+          end
+
+          def supplement(_tokens)
+            {}
+          end
+
+          def scopes
+            provider.scope_list
+          end
+
+          def authorize_url(callback, handoff)
+            delegated = handoff["delegated"]
+
+            provider.authorize_url(
+              redirect_uri: callback,
+              state: handoff["state"],
+              scopes: delegated ? Scopes.union(scopes, provider.delegated_scope_list) : scopes,
+              nonce: handoff["nonce"],
+              challenge: challenge(handoff["verifier"]),
+              extra: delegated ? delegation_extra : {}
+            )
+          end
+
+          def delegation_extra
+            provider.delegation_params.is_a?(Hash) ? provider.delegation_params.stringify_keys : {}
+          end
+
+          def challenge(verifier)
+            Base64.urlsafe_encode64(OpenSSL::Digest::SHA256.digest(verifier), padding: false)
+          end
+
+          def normalize(raw)
+            map = provider.claim_map
+
+            held = Provider::MAPPED_CLAIMS.index_with do |claim|
+              map.key?(claim) ? dig(raw, map[claim]) : raw[claim]
+            end
+
+            held["sub"] = dig(raw, map["sub"])&.to_s.presence
+            held[Provider::GROUPS] = Array(groups(raw)).map(&:to_s).presence if provider.organization_id
+            held.compact
+          end
+
+          def groups(raw)
+            claim = provider.group_claim
+
+            raw.key?(claim) ? raw[claim] : dig(raw, claim)
+          end
+
+          def dig(raw, path)
+            path.to_s.split(".").reduce(raw) do |held, part|
+              case held
+              when Hash then held[part]
+              when Array then part.match?(/\A\d+\z/) ? held[part.to_i] : nil
+              end
+            end
+          end
+
+          def upstream_error(params)
+            [ params["error"], params["error_description"] ].compact_blank.join(": ")
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/federation/saml.rb

@@ -0,0 +1,120 @@
+module Masks
+  module Server
+    module Federation
+      class Saml < Protocol
+        CLOCK_DRIFT = 60.seconds
+        METADATA_LIMIT = 512.kilobytes
+        NAME_ID = "name_id".freeze
+        NAME_ID_FORMATS = SamlIdentity::NAME_ID_FORMATS
+
+        class << self
+          def parse_metadata(xml)
+            parsed = OneLogin::RubySaml::IdpMetadataParser.new.parse_to_hash(
+              xml.to_s,
+              sso_binding: [ OneLogin::RubySaml::Utils::BINDINGS[:redirect] ]
+            )
+
+            certificates = Array(parsed.dig(:idp_cert_multi, :signing)).presence || Array(parsed[:idp_cert])
+
+            {
+              idp_entity_id: parsed[:idp_entity_id],
+              idp_sso_url: parsed[:idp_sso_service_url],
+              idp_certificates: certificates.compact_blank.map { |one| pem(one) }.join("\n")
+            }
+          rescue REXML::ParseException, ArgumentError, OpenSSL::X509::CertificateError => e
+            raise Provider::Untrusted, "that metadata could not be read: #{e.message.lines.first.to_s.strip}"
+          end
+
+          def pem(certificate)
+            OneLogin::RubySaml::Utils.format_cert(certificate.to_s.strip)
+          end
+        end
+
+        def start(callback:)
+          handoff = { "state" => SecureRandom.urlsafe_base64(STATE_BYTES) }
+          request = OneLogin::RubySaml::Authrequest.new
+
+          location = request.create(settings(callback), RelayState: handoff["state"])
+
+          [ location, handoff.merge("request_id" => request.request_id) ]
+        end
+
+        def finish(params, handoff:, callback:)
+          relay = params["RelayState"].presence || params["state"]
+
+          unless relay.present? && ActiveSupport::SecurityUtils.secure_compare(relay.to_s, handoff["state"].to_s)
+            raise Provider::Untrusted, "the relay state did not match this browser"
+          end
+
+          raise Provider::Refused, "#{provider.name} returned no SAML response" if params["SAMLResponse"].blank?
+
+          response = OneLogin::RubySaml::Response.new(
+            params["SAMLResponse"].to_s,
+            settings: settings(callback),
+            matches_request_id: handoff["request_id"].to_s,
+            allowed_clock_drift: CLOCK_DRIFT
+          )
+
+          unless response.is_valid?(true)
+            raise Provider::Untrusted, "#{provider.name} sent an assertion this server could not trust: #{response.errors.first}"
+          end
+
+          identity = normalize(response)
+
+          raise Provider::Untrusted, "#{provider.name} named nobody in that assertion" if identity["sub"].blank?
+
+          identity
+        end
+
+        def entity_id
+          "#{Current.origin}/login/provider/#{provider.key}/metadata"
+        end
+
+        def metadata(callback:)
+          OneLogin::RubySaml::Metadata.new.generate(settings(callback), true)
+        end
+
+        private
+
+          def settings(callback)
+            OneLogin::RubySaml::Settings.new.tap do |settings|
+              settings.sp_entity_id = entity_id
+              settings.assertion_consumer_service_url = callback
+              settings.idp_entity_id = provider.idp_entity_id
+              settings.idp_sso_service_url = provider.idp_sso_url
+              settings.idp_cert_multi = { signing: provider.idp_certificate_list, encryption: [] }
+              settings.name_identifier_format = provider.name_id_format.presence
+              settings.soft = true
+              settings.security[:want_assertions_signed] = true
+              settings.security[:strict_audience_validation] = true
+              settings.security[:digest_method] = XMLSecurity::Document::SHA256
+              settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA256
+            end
+          end
+
+          def normalize(response)
+            map = provider.claim_map
+            attributes = response.attributes
+
+            held = Provider::MAPPED_CLAIMS.index_with do |claim|
+              next if claim == "email_verified"
+
+              attribute(attributes, map.fetch(claim, claim))
+            end
+
+            held["sub"] = map["sub"] == NAME_ID ? response.name_id.to_s.presence : attribute(attributes, map["sub"])&.to_s.presence
+            held["email"] = held["email"].to_s.strip.downcase.presence
+            held[Provider::GROUPS] = Array(attributes.multi(provider.group_claim)).map(&:to_s).presence if provider.organization_id
+
+            held.compact
+          end
+
+          def attribute(attributes, name)
+            value = attributes[name.to_s]
+
+            value.is_a?(Array) ? value.first : value
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/forward_code.rb

@@ -0,0 +1,13 @@
+module Masks
+  module Server
+    class ForwardCode < Token
+      def self.lifetime
+        2.minutes
+      end
+
+      def return_to
+        held("return_to")
+      end
+    end
+  end
+end