masks-server 0.7.0

data/app/models/masks/server/issuer.rb

@@ -0,0 +1,205 @@
+module Masks
+  module Server
+    class Issuer
+      ACR_PASSWORD = "urn:masks:acr:pwd".freeze
+      ACR_MULTI_FACTOR = "urn:masks:acr:mfa".freeze
+      MULTI_FACTOR = "mfa".freeze
+      ACR_VALUES = [ ACR_PASSWORD, ACR_MULTI_FACTOR ].freeze
+      LOGOUT_EVENT = "http://schemas.openid.net/event/backchannel-logout".freeze
+      LOGOUT_TOKEN_LIFETIME = 2.minutes
+      LOGOUT_TOKEN_TYPE = "logout+jwt".freeze
+
+      attr_reader :tenant, :origin
+
+      def initialize(tenant, origin)
+        @tenant = tenant
+        @origin = origin.to_s.chomp("/")
+      end
+
+      def url
+        origin
+      end
+
+      def key
+        @key ||= tenant.signing_key
+      end
+
+      def manage_resource
+        "#{url}/manage"
+      end
+
+      def protected_resource
+        {
+          "resource" => manage_resource,
+          "authorization_servers" => [ url ],
+          "scopes_supported" => ManageRoles::SCOPES,
+          "bearer_methods_supported" => [ "header" ],
+          "tenant" => tenant.to_identity
+        }.merge(manage_descriptions)
+      end
+
+      def manage_descriptions
+        default = { "scope_descriptions" => described_manage(I18n.default_locale) }
+
+        Locales.available.reduce(default) do |held, locale|
+          held.merge("scope_descriptions##{Locales.tag(locale)}" => described_manage(locale))
+        end
+      end
+
+      def described_manage(locale)
+        ManageRoles::SCOPES.index_with { |scope| Scopes.description_for(scope, locale: locale) }
+      end
+
+      def sign(claims, typ: "JWT")
+        key.sign(claims, typ: typ)
+      end
+
+      def verify(token, typ:, required:, verify_expiration: true)
+        claims, header = JWT.decode(
+          token.to_s, nil, true,
+          algorithms: [ SigningKey::ALGORITHM ],
+          jwks: jwks,
+          iss: url, verify_iss: true,
+          verify_expiration: verify_expiration,
+          required_claims: required
+        )
+
+        held = header["typ"].to_s.downcase.delete_prefix("application/")
+
+        raise JWT::DecodeError, "that token is typed #{header['typ'].inspect}, not #{typ}" unless held == typ
+
+        claims
+      end
+
+      def jwks
+        @jwks ||= { "keys" => Tenant.switch(tenant) { SigningKey.published.map(&:public_jwk) } }
+      end
+
+      def half_hash(value)
+        return nil if value.blank?
+
+        digest = OpenSSL::Digest::SHA256.digest(value.to_s)
+
+        Base64.urlsafe_encode64(digest[0, digest.bytesize / 2], padding: false)
+      end
+
+      def subject_for(actor, client)
+        return nil if actor.nil?
+
+        held = [ actor.id, client&.id ]
+
+        (@subjects ||= {}).fetch(held) { @subjects[held] = Subjects.for(actor, client) }
+      end
+
+      def id_token(actor:, client:, nonce: nil, issued_at: Time.current,
+                   authenticated_at: nil, access_token: nil, code: nil, amr: nil, sid: nil, organization: nil,
+                   groups: nil)
+        subject = subject_for(actor, client)
+
+        sign({
+          "iss" => url,
+          "sub" => subject,
+          "aud" => client.client_id,
+          "exp" => 15.minutes.from_now.to_i,
+          "iat" => issued_at.to_i,
+          "auth_time" => (authenticated_at || issued_at).to_i,
+          "acr" => acr_for(amr),
+          "amr" => Array(amr).presence,
+          "nonce" => nonce,
+          "sid" => sid,
+          Organization::CLAIM => organization&.claim_for(actor),
+          Actor::GROUPS_CLAIM => groups,
+          "at_hash" => half_hash(access_token),
+          "c_hash" => half_hash(code),
+          "tenant" => tenant.to_identity,
+          Actor::AVATARS_CLAIM => Avatars.urls(actor, subject: subject, origin: url)
+        }.compact)
+      end
+
+      def logout_token(client:, subject:, sid: nil, issued_at: Time.current)
+        sign({
+          "iss" => url,
+          "aud" => client.client_id,
+          "iat" => issued_at.to_i,
+          "exp" => (issued_at + LOGOUT_TOKEN_LIFETIME).to_i,
+          "jti" => SecureRandom.uuid,
+          "events" => { LOGOUT_EVENT => {} },
+          "sub" => subject,
+          "sid" => sid
+        }.compact, typ: LOGOUT_TOKEN_TYPE)
+      end
+
+      def acr_for(amr)
+        Array(amr).include?(MULTI_FACTOR) ? ACR_MULTI_FACTOR : ACR_PASSWORD
+      end
+
+      def signals_configuration
+        {
+          "spec_version" => "1_0",
+          "issuer" => url,
+          "jwks_uri" => "#{url}/.well-known/jwks.json",
+          "delivery_methods_supported" => [ SignalStream::PUSH ],
+          "configuration_endpoint" => "#{url}/ssf/streams",
+          "status_endpoint" => "#{url}/ssf/status",
+          "verification_endpoint" => "#{url}/ssf/verify",
+          "authorization_schemes" => [ { "spec_urn" => "urn:ietf:rfc:6749" } ],
+          "default_subjects" => "ALL"
+        }
+      end
+
+      def discovery
+        {
+          "issuer" => url,
+          "tenant" => tenant.to_identity,
+          "authorization_endpoint" => "#{url}/authorize",
+          "token_endpoint" => "#{url}/token",
+          "userinfo_endpoint" => "#{url}/userinfo",
+          "avatar_endpoint" => "#{url}/avatars",
+          "avatar_styles_supported" => Avatars::STYLES,
+          "avatar_sizes_supported" => Avatars::SIZES,
+          "jwks_uri" => "#{url}/.well-known/jwks.json",
+          "registration_endpoint" => (("#{url}/register") if tenant.registers?),
+          "client_id_metadata_document_supported" => tenant.registers?,
+          "pushed_authorization_request_endpoint" => "#{url}/par",
+          "device_authorization_endpoint" => "#{url}/device_authorization",
+          "handshake_endpoint" => "#{url}/handshake",
+          "masks_protocol_version" => Masks::PROTOCOL_VERSION,
+          "revocation_endpoint" => "#{url}/revoke",
+          "introspection_endpoint" => "#{url}/introspect",
+          "end_session_endpoint" => "#{url}/logout",
+          "frontchannel_logout_supported" => false,
+          "backchannel_logout_supported" => true,
+          "backchannel_logout_session_supported" => true,
+          "scopes_supported" => Scopes::DESCRIBED.keys,
+          "ui_locales_supported" => Locales.available.map { |locale| Locales.tag(locale) },
+          "response_types_supported" => Client::RESPONSE_TYPES,
+          "response_modes_supported" => [ "query" ],
+          "grant_types_supported" => Client::GRANT_TYPES,
+          "revocation_endpoint_auth_methods_supported" => Client::AUTH_METHODS,
+          "introspection_endpoint_auth_methods_supported" => Client::AUTH_METHODS,
+          "subject_types_supported" => Subjects::TYPES,
+          "acr_values_supported" => ACR_VALUES,
+          "id_token_signing_alg_values_supported" => [ SigningKey::ALGORITHM ],
+          "token_endpoint_auth_methods_supported" => Client::AUTH_METHODS,
+          "token_endpoint_auth_signing_alg_values_supported" => ClientKeys::ALGORITHMS,
+          "revocation_endpoint_auth_signing_alg_values_supported" => ClientKeys::ALGORITHMS,
+          "introspection_endpoint_auth_signing_alg_values_supported" => ClientKeys::ALGORITHMS,
+          "code_challenge_methods_supported" => Client::CHALLENGE_METHODS,
+          "dpop_signing_alg_values_supported" => Proof::ALGORITHMS,
+          "claims_supported" => %w[
+            iss sub aud exp iat auth_time nonce sid
+            preferred_username name picture email email_verified tenant act identities org orgs groups
+          ] + [ Actor::AVATARS_CLAIM ],
+          "authorization_response_iss_parameter_supported" => true,
+          "resource_indicators_supported" => true,
+          "require_pushed_authorization_requests" => false,
+          "request_parameter_supported" => true,
+          "request_object_signing_alg_values_supported" => ClientKeys::ALGORITHMS,
+          "request_uri_parameter_supported" => false,
+          "claims_parameter_supported" => true,
+          "authorization_details_types_supported" => AuthorizationDetails.supported_types
+        }.compact
+      end
+    end
+  end
+end

data/app/models/masks/server/journey.rb

@@ -0,0 +1,97 @@
+module Masks
+  module Server
+    class Journey
+      SIGN_IN = "sign_in".freeze
+      ACCOUNT = "account".freeze
+      MANAGE = "manage".freeze
+      SYSTEM = "system".freeze
+
+      AUTHORIZATION = "authorization".freeze
+      DEVICE = "device".freeze
+      SAML = "saml".freeze
+
+      LOGO = 88
+
+      attr_reader :kind, :via, :client, :by, :origin
+
+      class << self
+        def sign_in(login)
+          request = login.request
+
+          new(kind: SIGN_IN, client: login.client, via: request && via_for(request))
+        end
+
+        def account(actor)
+          new(kind: ACCOUNT, by: actor)
+        end
+
+        def manage(by)
+          new(kind: MANAGE, by: by)
+        end
+
+        def system(origin: nil)
+          new(kind: SYSTEM, origin: origin)
+        end
+
+        def load(held)
+          new(
+            kind: held["kind"], via: held["via"], origin: held["origin"],
+            client: located(held["client"]), by: located(held["by"])
+          )
+        end
+
+        private
+
+          def located(gid)
+            GlobalID::Locator.locate(gid)
+          rescue ActiveRecord::RecordNotFound
+            nil
+          end
+
+          def via_for(request)
+            return DEVICE if request.device?
+            return SAML if request.saml?
+
+            AUTHORIZATION
+          end
+      end
+
+      def initialize(kind:, via: nil, client: nil, by: nil, origin: nil)
+        @kind = kind
+        @via = via
+        @client = client
+        @by = by
+        @origin = origin.presence || Current.origin.presence || Current.tenant&.public_origin
+      end
+
+      def dump
+        {
+          "kind" => kind, "via" => via, "origin" => origin,
+          "client" => client&.to_global_id&.to_s, "by" => by&.to_global_id&.to_s
+        }
+      end
+
+      def tenant_name
+        Current.tenant&.name
+      end
+
+      def branded?
+        client.present? && client.approved?
+      end
+
+      def heading
+        branded? ? client.name : tenant_name
+      end
+
+      def logo_url
+        return nil unless branded? && client.logo_digest.present? && origin.present?
+
+        "#{origin}#{Engine.routes.url_helpers.client_logo_path(client.client_id, v: client.logo_digest, size: LOGO)}"
+      end
+
+      def manager
+        by if kind == MANAGE
+      end
+    end
+  end
+end

data/app/models/masks/server/ldap_credential.rb

@@ -0,0 +1,51 @@
+module Masks
+  module Server
+    class LdapCredential < Token
+      LABEL = /\A[a-z0-9][a-z0-9._-]{0,62}\z/
+      LIFETIME = 100.years
+
+      class Refused < StandardError; end
+
+      class << self
+        def issue!(label:, by:)
+          name = label.to_s.strip.downcase
+          raise Refused, "a label is lowercase letters, digits, dots, dashes, and underscores" unless name.match?(LABEL)
+          raise Refused, "a live LDAP credential is already labeled #{name}" if named(name)
+
+          mint!(payload: { "label" => name, "issued_by" => by&.uuid }.compact, expires_at: LIFETIME.from_now)
+        end
+
+        def named(label)
+          live.find_by("payload->>'label' = ?", label.to_s.downcase)
+        end
+
+        def check(label, secret)
+          held = named(label)
+          offered = Digest::SHA256.hexdigest(secret.to_s)
+
+          return nil unless held && secret.present? && ActiveSupport::SecurityUtils.secure_compare(held.digest, offered)
+
+          held
+        end
+      end
+
+      def label
+        held("label")
+      end
+
+      def issued_by
+        Actor.find_by(uuid: held("issued_by")) if held("issued_by")
+      end
+
+      def used_at
+        held("used_at")&.then { |value| Time.zone.parse(value) }
+      end
+
+      def used!
+        return if used_at && used_at > 5.minutes.ago
+
+        update_columns(payload: (payload || {}).merge("used_at" => Time.current.iso8601))
+      end
+    end
+  end
+end

data/app/models/masks/server/linking.rb

@@ -0,0 +1,81 @@
+module Masks
+  module Server
+    class Linking
+      class Refused < StandardError; end
+
+      HELD = "provider_linking".freeze
+      WINDOW = 15.minutes
+
+      class << self
+        def offered(actor)
+          policy = SignInPolicy.for
+          linked = Connection.live.where(actor: actor).pluck(:provider_id)
+
+          return [] unless policy.first_factor?(:provider)
+
+          Provider.signing_in.where.not(id: linked).order(:name).select { |provider| policy.offers?(provider) }
+        end
+
+        def start!(session:, provider:, actor:, authenticated_at:)
+          raise Refused, I18n.t("connections.unavailable") if provider.nil? || !offered(actor).include?(provider)
+          raise Refused, I18n.t("connections.stale") if authenticated_at.nil? || authenticated_at < Session::FRESHNESS.ago
+
+          location, handoff = provider.federation.start(callback: provider.callback_url)
+
+          session[HELD] = handoff.merge(
+            "provider_id" => provider.id,
+            "actor_id" => actor.id,
+            "expires_at" => WINDOW.from_now.to_i
+          )
+
+          location
+        end
+
+        def pending?(session, params)
+          held = session[HELD]
+
+          answers?(held, params["RelayState"].presence || params["state"])
+        end
+
+        def answers?(held, presented)
+          held.present? && presented.present? &&
+            ActiveSupport::SecurityUtils.secure_compare(presented.to_s, held["state"].to_s)
+        end
+
+        def finish!(session:, provider:, actor:, params:)
+          held = session.delete(HELD)
+
+          raise Refused, I18n.t("connections.expired") if held.blank? || held["expires_at"].to_i <= Time.current.to_i
+          raise Refused, I18n.t("connections.expired") unless actor && actor.id == held["actor_id"]
+          raise Refused, I18n.t("connections.unavailable") unless provider && provider.id == held["provider_id"]
+
+          identity = provider.federation.finish(params, handoff: held, callback: provider.callback_url)
+
+          link!(provider, actor, identity)
+        rescue Provider::Untrusted, Provider::Refused, Provider::Unreachable => e
+          Event.record!(Event::CONNECTION_REFUSED, actor: actor, by: nil, provider: provider&.key, reason: e.message)
+
+          raise Refused, I18n.t("connections.failed", provider: provider&.name)
+        end
+
+        private
+
+          def link!(provider, actor, identity)
+            held = Connection.find_by(provider: provider, subject: identity["sub"].to_s)
+
+            if held && !held.revoked? && held.actor_id != actor.id
+              Event.record!(Event::CONNECTION_REFUSED, actor: actor, by: nil, provider: provider.key, reason: "already linked to another account")
+
+              raise Refused, I18n.t("connections.taken", provider: provider.name)
+            end
+
+            connection = Connection.record!(provider: provider, actor: actor, identity: identity)
+
+            Event.record!(Event::CONNECTION_LINKED, actor: actor, by: nil, provider: provider.key)
+
+            connection
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/locales.rb

@@ -0,0 +1,55 @@
+module Masks
+  module Server
+    module Locales
+      LONGEST = 512
+      TAG = /\A[a-z]{1,8}(?:-[a-z0-9]{1,8})*\z/
+      QUALITY = /\Aq=(\d(?:\.\d{1,3})?)\z/i
+
+      class << self
+        def available
+          I18n.available_locales
+        end
+
+        def negotiate(header, asked: nil)
+          chosen(asked.to_s.split) || chosen(requested(header)) || I18n.default_locale
+        end
+
+        def tag(locale = I18n.locale)
+          locale.to_s.tr("_", "-")
+        end
+
+        private
+
+          def chosen(tags)
+            tags.first(10).lazy.filter_map { |tag| tag.to_s.downcase.match?(TAG) && match(tag.to_s.downcase) }.first
+          end
+
+          def requested(header)
+            header.to_s[0, LONGEST].split(",").filter_map { |entry| weighed(entry) }
+                  .sort_by { |_, weight| -weight }
+                  .map(&:first)
+          end
+
+          def weighed(entry)
+            tag, *parameters = entry.split(";").map { |part| part.strip.downcase }
+            return nil unless tag&.match?(TAG)
+
+            given = parameters.filter_map { |parameter| parameter[QUALITY, 1] }.first
+            weight = given ? Float(given, exception: false) : 1.0
+            return nil if weight.nil? || weight <= 0
+
+            [ tag, weight ]
+          end
+
+          def match(tag)
+            exact = available.find { |locale| self.tag(locale).downcase == tag }
+            return exact if exact
+
+            language = tag.split("-").first
+
+            available.find { |locale| self.tag(locale).downcase.split("-").first == language }
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/localized.rb

@@ -0,0 +1,42 @@
+module Masks
+  module Server
+    module Localized
+      SUFFIX = "#".freeze
+
+      class << self
+        def fields(document, name, locale: I18n.locale)
+          return {} unless document.is_a?(Hash)
+
+          tagged = tags(document, name)
+          untagged = tagged.delete(nil)
+
+          preferred(locale).reverse.reduce(hash(untagged)) do |held, tag|
+            held.merge(hash(tagged[tag]))
+          end
+        end
+
+        private
+
+          def tags(document, name)
+            document.each_with_object({}) do |(key, value), held|
+              field, tag = key.to_s.split(SUFFIX, 2)
+              next unless field == name
+
+              held[tag&.downcase] = value
+            end
+          end
+
+          def preferred(locale)
+            tag = Locales.tag(locale).downcase
+            language = tag.split("-").first
+
+            [ tag, language ].uniq
+          end
+
+          def hash(value)
+            value.is_a?(Hash) ? value : {}
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/locked_out.rb

@@ -0,0 +1,30 @@
+module Masks
+  module Server
+    module LockedOut
+      class << self
+        def recover!(named = ::Rails.configuration.masks.recover)
+          return [] if named.blank?
+
+          subdomain, identifier = named.include?("/") ? named.split("/", 2) : [ nil, named ]
+          tenants = subdomain ? Tenant.active.where(subdomain: subdomain) : Tenant.active
+
+          tenants.filter_map { |tenant| Tenant.switch(tenant) { recover_in(tenant, identifier) } }
+        end
+
+        private
+
+          def recover_in(tenant, identifier)
+            actor = Actor.locate(identifier)
+            return if actor.nil?
+
+            HelpRequests.reset!(actor, by: nil)
+            reset = PasswordReset.open!(actor: actor)
+            Event.record!(Event::PASSWORD_RESET_REQUESTED, actor: actor, by: nil, from: "MASKS_RECOVER")
+
+            "#{tenant.subdomain}: #{actor.identifier} has no second factors now and every session is signed out. " \
+              "This link sets a new password once: #{reset.url(tenant.public_origin.to_s)}"
+          end
+      end
+    end
+  end
+end