masks-server 0.7.0

data/app/models/masks/server/forward_session.rb

@@ -0,0 +1,14 @@
+module Masks
+  module Server
+    class ForwardSession < Token
+      COOKIE = "masks_forward".freeze
+
+      def self.held(secret, client)
+        token = redeem(secret)
+
+        token if token && token.client_id == client.id && token.session&.live? && !token.actor.suspended? &&
+                 client.admits?(token.actor)
+      end
+    end
+  end
+end

data/app/models/masks/server/forwarded.rb

@@ -0,0 +1,40 @@
+module Masks
+  module Server
+    module Forwarded
+      class << self
+        def origin(value)
+          uri = value.is_a?(URI::Generic) ? value : URI.parse(value.to_s)
+          return nil unless uri.is_a?(URI::HTTP) && uri.host.present?
+
+          port = ":#{uri.port}" unless uri.port == uri.default_port
+          "#{uri.scheme}://#{uri.host.downcase}#{port}"
+        rescue URI::InvalidURIError
+          nil
+        end
+
+        def target(request)
+          held = request.env[ForwardedApp::KEY] || {}
+          original = held["HTTP_X_ORIGINAL_URL"].presence
+          return parse(original) if original
+
+          host = held["HTTP_X_FORWARDED_HOST"].to_s.split(",").first.to_s.strip
+          return nil if host.empty?
+
+          scheme = request.headers["X-Forwarded-Proto"].to_s.split(",").first.to_s.strip.presence || "https"
+          path = held["HTTP_X_FORWARDED_URI"].presence || "/"
+
+          parse("#{scheme}://#{host}#{path}")
+        end
+
+        private
+
+          def parse(value)
+            uri = URI.parse(value)
+            uri if uri.is_a?(URI::HTTP) && uri.host.present?
+          rescue URI::InvalidURIError
+            nil
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/group.rb

@@ -0,0 +1,31 @@
+module Masks
+  module Server
+    class Group < ApplicationRecord
+      include TenantScoped
+
+      KEY = /\A[a-z0-9][a-z0-9._-]*\z/
+
+      has_many :members, class_name: "GroupMember", dependent: :delete_all
+      has_many :actors, through: :members
+
+      normalizes :key, with: ->(value) { value.to_s.strip.downcase }
+      normalizes :name, with: ->(value) { value.to_s.strip }
+
+      validates :key, presence: true, format: { with: KEY }, length: { maximum: 64 },
+                      uniqueness: { scope: :tenant_id }
+      validates :name, presence: true, length: { maximum: 100 }
+
+      def add!(actor, by: nil)
+        member = members.find_or_create_by!(actor: actor)
+        Event.record!(Event::GROUP_JOINED, actor: actor, by: by, group: key) if member.previously_new_record?
+        member
+      end
+
+      def remove!(actor, by: nil)
+        removed = members.where(actor: actor).delete_all.positive?
+        Event.record!(Event::GROUP_LEFT, actor: actor, by: by, group: key) if removed
+        removed
+      end
+    end
+  end
+end

data/app/models/masks/server/group_member.rb

@@ -0,0 +1,10 @@
+module Masks
+  module Server
+    class GroupMember < ApplicationRecord
+      include TenantScoped
+
+      belongs_to :group
+      belongs_to :actor
+    end
+  end
+end

data/app/models/masks/server/handshake.rb

@@ -0,0 +1,172 @@
+module Masks
+  module Server
+    class Handshake
+      GRANT_TYPES = %w[authorization_code refresh_token].freeze
+
+      attr_reader :name, :redirect_uris, :resource, :scopes, :return_to, :state, :auth_method,
+                  :backchannel_logout_uri
+
+      class << self
+        def from_request(request)
+          repeated = Rack::Utils.parse_query(request.query_string)
+          params = request.params
+
+          new(
+            name: params["client_name"],
+            redirect_uris: repeated["redirect_uris"] || params["redirect_uris"],
+            resource: params["resource"],
+            scopes: params["scope"],
+            return_to: params["return_to"],
+            state: params["state"],
+            auth_method: params["token_endpoint_auth_method"],
+            backchannel_logout_uri: params["backchannel_logout_uri"]
+          )
+        end
+
+        def from_row(row)
+          return nil if row.nil?
+
+          held = row.payload || {}
+
+          new(
+            name: held["name"],
+            redirect_uris: held["redirect_uris"],
+            resource: row.audience.first,
+            scopes: row.scopes,
+            return_to: row.redirect_uri,
+            state: held["state"],
+            auth_method: held["auth_method"],
+            backchannel_logout_uri: held["backchannel_logout_uri"]
+          )
+        end
+      end
+
+      def grant_types
+        Scopes.delegable(scopes).any? ? GRANT_TYPES + [ Exchange::GRANT_TYPE ] : GRANT_TYPES
+      end
+
+      def canonical
+        {
+          "name" => name,
+          "resource" => resource,
+          "scopes" => scopes.sort.join(" "),
+          "return_to" => return_to,
+          "state" => state,
+          "redirect_uris" => redirect_uris.sort,
+          "auth_method" => auth_method,
+          "backchannel_logout_uri" => backchannel_logout_uri
+        }.compact
+      end
+
+      def fingerprint
+        Digest::SHA256.hexdigest(canonical.to_json)
+      end
+
+      def query_pairs
+        pairs = [
+          [ "client_name", name ],
+          [ "resource", resource ],
+          [ "scope", scopes.join(" ") ],
+          [ "return_to", return_to ],
+          [ "token_endpoint_auth_method", auth_method ]
+        ]
+
+        pairs << [ "state", state ] if state
+        pairs << [ "backchannel_logout_uri", backchannel_logout_uri ] if backchannel_logout_uri
+        redirect_uris.each { |uri| pairs << [ "redirect_uris", uri ] }
+        pairs
+      end
+
+      def initialize(name: nil, redirect_uris: nil, resource: nil, scopes: nil,
+                     return_to: nil, state: nil, auth_method: nil, backchannel_logout_uri: nil)
+        @name = name.to_s.strip.presence || "An application"
+        @redirect_uris = Array(redirect_uris).map(&:to_s).reject(&:empty?).uniq
+        @resource = resource.to_s
+        @scopes = Scopes.list(scopes)
+        @return_to = return_to.to_s
+        @state = state.presence
+        @auth_method = auth_method.to_s.presence || Client::DEFAULT_AUTH_METHOD
+        @backchannel_logout_uri = backchannel_logout_uri.to_s.strip.presence
+      end
+
+      def origin
+        @origin ||= origin_of(resource)
+      end
+
+      def credentials
+        return "secret" if Client::SECRET_AUTH_METHODS.include?(auth_method)
+        return "key" if auth_method == Client::PRIVATE_KEY_JWT
+
+        "public"
+      end
+
+      def usable?
+        refusal.nil?
+      end
+
+      def refusal
+        return @refusal if defined?(@refusal)
+
+        @refusal = check
+      end
+
+      def approved(secret, issuer:)
+        answer("initial_access_token" => secret, "iss" => issuer)
+      end
+
+      def declined
+        answer(
+          "error" => "access_denied",
+          "error_description" => "the person signing in declined"
+        )
+      end
+
+      private
+
+        def check
+          return "a resource is required" if resource.blank?
+          return "the resource must be an absolute https URL" if origin.nil?
+          return "at least one redirect_uris is required" if redirect_uris.empty?
+          return "a return_to is required" if return_to.blank?
+          return "a scope is required" if scopes.empty?
+
+          unless Client::AUTH_METHODS.include?(auth_method)
+            return "token_endpoint_auth_method must be one of #{Client::AUTH_METHODS.join(', ')}"
+          end
+
+          elsewhere = ([ return_to ] + redirect_uris + Array(backchannel_logout_uri))
+            .reject { |uri| origin_of(uri) == origin }
+          return "everything must share the origin #{origin}: #{elsewhere.join(', ')}" if elsewhere.any?
+
+          nil
+        end
+
+        def answer(pairs)
+          uri = URI.parse(return_to)
+          query = Rack::Utils.parse_query(uri.query).merge(pairs)
+          query["state"] = state if state
+
+          uri.query = Rack::Utils.build_query(query)
+          uri.to_s
+        end
+
+        def origin_of(value)
+          uri = URI.parse(value.to_s)
+
+          return nil if uri.host.blank? || uri.fragment.present?
+          return nil unless uri.scheme == "https" || http?(uri)
+
+          port = ":#{uri.port}" unless uri.port == uri.default_port
+          "#{uri.scheme}://#{uri.host}#{port}"
+        rescue URI::InvalidURIError
+          nil
+        end
+
+        def http?(uri)
+          return false unless uri.scheme == "http"
+
+          ::Rails.env.local? || Client.loopback?(uri)
+        end
+    end
+  end
+end

data/app/models/masks/server/help_requests.rb

@@ -0,0 +1,50 @@
+module Masks
+  module Server
+    module HelpRequests
+      AGAIN_AFTER = 1.day
+
+      class << self
+        def request!(actor, journey:)
+          return false if actor.recovery_requested_at&.after?(AGAIN_AFTER.ago)
+
+          actor.update!(recovery_requested_at: Time.current)
+          Event.record!(Event::RECOVERY_REQUESTED, actor: actor)
+
+          return true unless ActorMailer.deliverable?
+
+          helpers.where.not(email_verified_at: nil).where.not(id: actor.id).find_each do |manager|
+            ActorMailer.recovery_requested(manager, actor, journey: journey).deliver_later
+          end
+
+          true
+        end
+
+        def reset!(actor, by:)
+          actor.transaction do
+            actor.passkeys.destroy_all
+            actor.update!(
+              otp_secret: nil, otp_enabled_at: nil, backup_code_digests: [], backup_codes_generated_at: nil,
+              email_factor_at: nil, phone_factor_at: nil, recovery_requested_at: nil
+            )
+            DeviceFactor.forget!(actor: actor)
+            actor.sign_out_everywhere!
+          end
+
+          Event.record!(Event::SECOND_FACTORS_RESET, actor: actor, by: by)
+        end
+
+        def dismiss!(actor, by:)
+          actor.update!(recovery_requested_at: nil)
+
+          Event.record!(Event::RECOVERY_DISMISSED, actor: actor, by: by)
+        end
+
+        private
+
+          def helpers
+            Actor.where(suspended_at: nil).merge(Actor.holding(Scopes::MANAGE).or(Actor.holding(Scopes::MANAGE_SUPPORT)))
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/identicon.rb

@@ -0,0 +1,71 @@
+module Masks
+  module Server
+    class Identicon
+      CONTENT_TYPE = "image/svg+xml".freeze
+      CELLS = 5
+      HALF = (CELLS + 1) / 2
+      MARGIN = 1
+      BOX = CELLS + (MARGIN * 2)
+
+      attr_reader :seed
+
+      def initialize(seed)
+        @seed = seed.to_s
+      end
+
+      def digest
+        @digest ||= Digest::SHA256.hexdigest("identicon:#{seed}")[0, 16]
+      end
+
+      def to_svg(size = nil)
+        side = size || 256
+
+        <<~SVG
+          <svg xmlns="http://www.w3.org/2000/svg" width="#{side}" height="#{side}" viewBox="0 0 #{BOX} #{BOX}" role="img">
+            <rect width="#{BOX}" height="#{BOX}" fill="#{background}"/>
+            #{squares}
+          </svg>
+        SVG
+      end
+
+      private
+
+        def bytes
+          @bytes ||= Digest::SHA256.digest("identicon:#{seed}").bytes
+        end
+
+        def hue
+          bytes[-1] * 360 / 256
+        end
+
+        def foreground
+          "hsl(#{hue} 58% 48%)"
+        end
+
+        def background
+          "hsl(#{hue} 44% 95%)"
+        end
+
+        def squares
+          filled.map do |column, row|
+            %(<rect x="#{column + MARGIN}" y="#{row + MARGIN}" width="1" height="1" fill="#{foreground}"/>)
+          end.join("\n    ")
+        end
+
+        def filled
+          cells = []
+
+          HALF.times do |column|
+            CELLS.times do |row|
+              next unless bytes[(column * CELLS) + row].even?
+
+              cells << [ column, row ]
+              cells << [ CELLS - 1 - column, row ] unless column == CELLS - 1 - column
+            end
+          end
+
+          cells
+        end
+    end
+  end
+end

data/app/models/masks/server/idle_accounts.rb

@@ -0,0 +1,96 @@
+module Masks
+  module Server
+    module IdleAccounts
+      WARNING = 30.days
+      SUSPEND = "suspend".freeze
+      DELETE = "delete".freeze
+      DELETE_SUSPENDED = "delete_suspended".freeze
+
+      class << self
+        def sweep(tenant)
+          candidates(tenant).find_each do |actor|
+            next unless stage(actor, tenant)
+
+            actor.with_lock do
+              stage = stage(actor, tenant)
+
+              settle(actor, tenant, stage) if stage
+            end
+          end
+        end
+
+        private
+
+          def days(tenant, stage)
+            stage == SUSPEND ? tenant.suspend_after : tenant.delete_after
+          end
+
+          def warn_from(days)
+            (days.days - WARNING).ago
+          end
+
+          def candidates(tenant)
+            unsuspended = Actor.where(suspended_at: nil)
+            eligible = tenant.delete_after ? unsuspended.or(Actor.where(suspension_reason: Actor::IDLE)) : unsuspended
+            soonest = [ tenant.suspend_after, tenant.delete_after ].compact.min
+
+            eligible.where.not(id: Actor.directed.select(:id))
+                    .where.not(activated_at: nil)
+                    .where("COALESCE(last_active_at, last_login_at, activated_at) < ?", warn_from(soonest))
+          end
+
+          def stage(actor, tenant)
+            return if actor.suspended? && actor.suspension_reason != Actor::IDLE
+
+            upcoming = actor.suspended? || tenant.suspend_after.nil? ? DELETE : SUSPEND
+            after = days(tenant, upcoming)
+
+            upcoming if after && actor.idle_since < warn_from(after)
+          end
+
+          def deadline(actor, tenant, stage)
+            [ actor.idle_since + days(tenant, stage).days, actor.idle_warned_at + WARNING ].max
+          end
+
+          def settle(actor, tenant, stage)
+            return if actor.idle_warned_at && deadline(actor, tenant, stage).future?
+            return if actor.last_manager?
+            return warn!(actor, tenant, stage) if actor.idle_warned_at.nil?
+
+            stage == SUSPEND ? suspend!(actor) : delete!(actor)
+          end
+
+          def warn!(actor, tenant, stage)
+            actor.update_columns(idle_warned_at: Time.current)
+
+            due = deadline(actor, tenant, stage)
+            notice = actor.suspended? ? DELETE_SUSPENDED : stage
+            mailed = Notifications.mailable?(actor)
+
+            Event.record!(Event::ACTOR_IDLE_WARNED, actor: actor, by: nil, mailed: mailed,
+                          due: due.iso8601, then: notice)
+
+            return unless mailed
+
+            ActorMailer.idle(actor, due: due, notice: notice, journey: Journey.system).deliver_later
+          end
+
+          def suspend!(actor)
+            actor.suspend!(reason: Actor::IDLE)
+
+            Event.record!(Event::ACTOR_SUSPENDED, actor: actor, by: nil, reason: Actor::IDLE,
+                          idle_since: actor.idle_since&.iso8601)
+          end
+
+          def delete!(actor)
+            held = { uuid: actor.uuid, identifier: actor.identifier, reason: Actor::IDLE,
+                     idle_since: actor.idle_since&.iso8601 }
+
+            actor.destroy!
+
+            Event.record!(Event::ACTOR_DELETED, by: nil, **held)
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/initial_access_token.rb

@@ -0,0 +1,14 @@
+module Masks
+  module Server
+    class InitialAccessToken < Token
+      def return_to
+        redirect_uri
+      end
+
+      def issue!
+        client.issue_credentials! unless held("keeping")
+        client
+      end
+    end
+  end
+end

data/app/models/masks/server/initials.rb

@@ -0,0 +1,75 @@
+module Masks
+  module Server
+    class Initials
+      CONTENT_TYPE = "image/svg+xml".freeze
+      LETTERS = 2
+      BOX = 100
+      FONT = "system-ui, -apple-system, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif".freeze
+
+      attr_reader :seed, :letters
+
+      def initialize(seed, *sources)
+        @seed = seed.to_s
+        @letters = self.class.letters_in(sources)
+      end
+
+      def self.letters_in(sources)
+        Array(sources).compact_blank.each do |source|
+          found = from(source)
+
+          return found if found.present?
+        end
+
+        "?"
+      end
+
+      def self.from(source)
+        words = source.to_s.scan(/[[:alnum:]]+/)
+
+        return "" if words.empty?
+        return words.first[0, LETTERS].upcase if words.one?
+
+        "#{words.first[0]}#{words.last[0]}".upcase
+      end
+
+      def digest
+        @digest ||= Digest::SHA256.hexdigest("initials:#{seed}:#{letters}")[0, 16]
+      end
+
+      def to_svg(size = nil)
+        side = size || 256
+
+        <<~SVG
+          <svg xmlns="http://www.w3.org/2000/svg" width="#{side}" height="#{side}" viewBox="0 0 #{BOX} #{BOX}" role="img">
+            <rect width="#{BOX}" height="#{BOX}" fill="#{background}"/>
+            <text x="50%" y="50%" fill="#{ink}" font-family="#{FONT}" font-size="#{font_size}"
+                  font-weight="560" letter-spacing="#{spacing}" text-anchor="middle"
+                  dominant-baseline="central">#{CGI.escape_html(letters)}</text>
+          </svg>
+        SVG
+      end
+
+      private
+
+        def hue
+          Digest::SHA256.digest("initials:#{seed}").bytes.last * 360 / 256
+        end
+
+        def background
+          "hsl(#{hue} 52% 42%)"
+        end
+
+        def ink
+          "hsl(#{hue} 46% 96%)"
+        end
+
+        def font_size
+          letters.length > 1 ? 40 : 48
+        end
+
+        def spacing
+          letters.length > 1 ? 1 : 0
+        end
+    end
+  end
+end

data/app/models/masks/server/invitation.rb

@@ -0,0 +1,29 @@
+module Masks
+  module Server
+    class Invitation < Token
+      include MailedLink
+
+      class Refused < StandardError; end
+
+      path "invite"
+
+      def self.lifetime
+        ::Rails.configuration.masks.invitation_lifetime
+      end
+
+      def self.open!(actor:, by: nil)
+        raise Refused, "#{actor.identifier} has already accepted an invitation" if actor.activated?
+
+        super
+      end
+
+      def self.accept!(secret, password)
+        claimed = claim(secret)
+        return nil if claimed.nil?
+
+        claimed.actor.activate!(password, verifying_email: claimed.delivered? && claimed.addressed?)
+        claimed.actor
+      end
+    end
+  end
+end

data/app/models/masks/server/invitations.rb

@@ -0,0 +1,24 @@
+module Masks
+  module Server
+    module Invitations
+      def self.open(actor:, journey:, membership: nil)
+        by = journey.by
+        invitation = Invitation.open!(actor: actor, by: by)
+
+        Event.record!(Event::INVITATION_SENT, actor: actor, by: by, email: actor.email)
+
+        return { delivered: false, url: invitation.url(Current.origin) } unless mailable?(actor)
+
+        ActorMailer.invitation(actor, invitation.url(Current.origin), journey: journey, membership: membership).deliver_later
+
+        invitation.delivered!
+
+        { delivered: true, url: nil }
+      end
+
+      def self.mailable?(actor)
+        ActorMailer.deliverable? && actor.email.present?
+      end
+    end
+  end
+end