masks-server 0.7.0

data/app/models/masks/server/login.rb

@@ -0,0 +1,469 @@
+module Masks
+  module Server
+    class Login
+      STATES = [
+        LoginStates::Invitation,
+        LoginStates::PasswordReset,
+        LoginStates::Passkey,
+        LoginStates::Provider,
+        LoginStates::Identifier,
+        LoginStates::Inbox,
+        LoginStates::Signup,
+        LoginStates::Password,
+        LoginStates::EmailCode,
+        LoginStates::FirstFactor,
+        LoginStates::RiskCheck,
+        LoginStates::Suspension,
+        LoginStates::AppAccess,
+        LoginStates::OrganizationChoice,
+        LoginStates::OneTimePassword,
+        LoginStates::BackupCode,
+        LoginStates::CodeFactor,
+        LoginStates::TrustedDevice,
+        LoginStates::SecondFactor,
+        LoginStates::Enrolment,
+        LoginStates::Confirmation,
+        LoginStates::Configure,
+        LoginStates::Delegation,
+        LoginStates::Consent
+      ].freeze
+
+      SETTLED = "settled".freeze
+      FIRST_FACTOR_BY = "first_factor_by".freeze
+
+      def self.permitted_updates
+        STATES.flat_map { |state| state.declared_updates }.uniq
+      end
+
+      def self.limit_for(event)
+        STATES.each do |state|
+          limit = state.declared_limits[event.to_s]
+          return limit if limit
+        end
+
+        nil
+      end
+
+      attr_reader :store, :updates, :event, :prompt, :warnings, :request, :session, :device, :refusal, :rid
+      attr_accessor :redirect_to
+
+      def initialize(store:, request: nil, session: nil, device: nil, rid: nil, event: nil, updates: {})
+        @store = store
+        @request = request
+        @session = session
+        @device = device
+        @rid = rid
+        @event = event.presence&.to_s
+        @updates = (updates || {}).stringify_keys
+        @warnings = []
+        @warning_fields = {}
+      end
+
+      def client
+        request&.client
+      end
+
+      def tenant
+        Current.tenant
+      end
+
+      def policy
+        return SignInPolicy.first_run if first_run?
+
+        @policies ||= {}
+        @policies[organization&.id] ||= SignInPolicy.for(client: client, tenant: tenant, organization: organization)
+      end
+
+      def organization
+        organization_named(state("organization-choice").chosen_key)
+      end
+
+      def named_organization
+        organization_named(request&.try(:organization_key))
+      end
+
+      def first_run?
+        return @first_run if defined?(@first_run)
+
+        @first_run = !Actor.exists?
+      end
+
+      def first_run!
+        remove_instance_variable(:@first_run) if defined?(@first_run)
+        remove_instance_variable(:@policies) if defined?(@policies)
+      end
+
+      def signing_up
+        signed_up = store[LoginStates::Signup::SIGNED_UP]
+        first = signed_up ? signed_up["first_run"] : first_run?
+
+        return nil unless signed_up || state("signup").enabled?
+
+        { "firstRun" => first, "steps" => LoginStates::Signup.steps(first, policy) }
+      end
+
+      def surface
+        prompt == "consent" || (signing_up && !settled?) ? "grant" : "challenge"
+      end
+
+      def identifier
+        store["identifier"]
+      end
+
+      def identifier=(value)
+        store["identifier"] = value.to_s.strip.presence
+      end
+
+      def actor
+        return @actor if defined?(@actor)
+
+        id = store["actor_id"]
+        @actor = id ? Actor.find_by(id: id) : session&.actor
+      end
+
+      def actor=(record)
+        disowned = actor&.id != record&.id
+
+        remove_instance_variable(:@actor) if defined?(@actor)
+        store["actor_id"] = record&.id
+
+        disown! if disowned
+      end
+
+      def disown!
+        store.delete("idled")
+        store.delete("factors")
+        store.delete("amr")
+        store.delete(FIRST_FACTOR_BY)
+      end
+
+      def factors
+        store["factors"] ||= {}
+      end
+
+      def amr
+        store["amr"] ||= []
+      end
+
+      def noted!(*methods)
+        amr.concat(methods.map(&:to_s))
+        amr.uniq!
+        amr
+      end
+
+      def touched?(key)
+        until_at = stamp(key, "until")
+
+        until_at.present? && until_at > Time.current
+      end
+
+      def factored_at(key)
+        stamp(key, "at")
+      end
+
+      PRECISION = 6
+
+      def factored!(key, expiry:)
+        now = Time.current
+
+        factors[key.to_s] = {
+          "at" => now.iso8601(PRECISION),
+          "until" => (now + expiry).iso8601(PRECISION)
+        }
+      end
+
+      def expire!(key)
+        store["factors"]&.delete(key.to_s)
+      end
+
+      def first_factored_by!(factor, provider: nil)
+        store[FIRST_FACTOR_BY] = { "factor" => factor.to_s, "provider_id" => provider&.id }.compact
+      end
+
+      def first_factored_by
+        return store[FIRST_FACTOR_BY] || {} if touched?(:first_factor)
+        return session.first_factored_by if signed_in?
+
+        {}
+      end
+
+      def organization_unsatisfied?
+        governing = organization&.sign_in_policy
+
+        return false if governing.nil? || governing.archived? || actor.nil? || first_run?
+
+        held = first_factored_by
+        provider = held["provider_id"] && Provider.signing_in.find_by(id: held["provider_id"])
+
+        return true if provider && !provider.offered_to?(organization)
+
+        !governing.admits_first_factor?(held["factor"], provider: provider)
+      end
+
+      def organization_refuses?
+        governing = organization&.sign_in_policy
+
+        governing.present? && !governing.archived? && actor.present? && !governing.admits?(actor.email)
+      end
+
+      def authenticated_at
+        factored_at(:first_factor) || (signed_in? ? session.authenticated_at : nil)
+      end
+
+      def signed_in?
+        session.present? && actor.present? && session.actor_id == actor.id
+      end
+
+      def reauthenticating?
+        return false unless request&.reauthenticate?
+
+        authenticated_at.nil? || authenticated_at < request.created_at
+      end
+
+      def stale?
+        return true if outlived? || idled?
+
+        age = request&.max_age
+        return false if age.nil?
+
+        authenticated_at.nil? || authenticated_at < age.to_i.seconds.ago
+      end
+
+      def outlived?
+        lifetime = policy.session_lifetime
+
+        lifetime.present? && authenticated_at.present? && authenticated_at < lifetime.seconds.ago
+      end
+
+      def idled?
+        timeout = policy.session_idle_timeout
+
+        return false if timeout.nil? || !signed_in? || touched?(:first_factor)
+
+        store["idled"] = true if session.idle_for > timeout
+
+        store["idled"] == true
+      end
+
+      def first_factored?
+        return false if reauthenticating? || stale? || actor.nil? || organization_unsatisfied?
+
+        touched?(:first_factor) || signed_in?
+      end
+
+      def stepping_up?
+        return false if multi_factored?
+
+        wanted = request.respond_to?(:multi_factor?) && request.multi_factor?
+
+        wanted || (request.present? && policy.apps_require_second_factor) || state("risk-check").stepping_up?
+      end
+
+      def multi_factored?
+        return true if amr.include?(Issuer::MULTI_FACTOR)
+
+        signed_in? && Array(session.amr).include?(Issuer::MULTI_FACTOR)
+      end
+
+      def second_factored?
+        return false if reauthenticating? || stale? || actor.nil? || stepping_up?
+
+        touched?(:second_factor) || signed_in? || remembered?(:second_factor)
+      end
+
+      def second_factor_pending?
+        state("second-factor").enabled? && !second_factored?
+      end
+
+      def remembered?(factor)
+        return false if device.nil? || actor.nil?
+
+        device.remembers?(actor, factor)
+      end
+
+      def remember!(factor, expiry: DeviceFactor::LIFETIME)
+        Event.record!(Event::DEVICE_TRUSTED, actor: actor, device: device, factor: factor.to_s)
+
+        DeviceFactor.remember!(device: device, actor: actor, factor: factor, expiry: expiry)
+      end
+
+      def warn!(*keys, field: nil)
+        @as_json = nil
+
+        keys.compact.map(&:to_s).each do |key|
+          warnings << key unless warnings.include?(key)
+          @warning_fields[key] = field.to_s if field
+        end
+      end
+
+      def carried
+        warnings.map { |key| [ key, @warning_fields[key] ] }
+      end
+
+      def carry!(held)
+        Array(held).each { |key, field| warn!(key, field: field) }
+      end
+
+      def settled?
+        prompt == SETTLED
+      end
+
+      def prompted?
+        prompt.present? && !settled?
+      end
+
+      def refused?
+        refusal.present?
+      end
+
+      def update
+        @as_json = nil
+        forget_vanished_actor!
+        states.each(&:reload!)
+        Current.organization = organization
+        states.each { |state| state.event!(event) } if event
+        Current.organization = organization
+        @prompting = nil
+
+        states.each do |state|
+          @prompting = state
+          state.factor!
+        end
+
+        @prompting = nil
+        @prompt = SETTLED
+        self
+      rescue LoginState::PromptRequired => denial
+        @prompt = denial.prompt
+        self
+      rescue LoginState::Refused => denial
+        @refusal = denial
+        self
+      ensure
+        states.each(&:cleanup!)
+      end
+
+      def start_over!
+        @as_json = nil
+        states.each(&:start_over!)
+        store.replace({})
+        self
+      end
+
+      def state(key)
+        states_by_key.fetch(key.to_s)
+      end
+
+      def messages
+        warnings.filter_map do |key|
+          notice = I18n.t("logins.notices.#{key}", default: nil)
+          text = notice || I18n.t("logins.warnings.#{key}", default: nil)
+
+          next unless text
+
+          { "key" => key, "text" => text, "tone" => notice ? "note" : "note note-bad", "field" => @warning_fields[key] }.compact
+        end
+      end
+
+      def message_for(field)
+        messages.find { |message| message["field"] == field.to_s }
+      end
+
+      def copy
+        key = prompt.to_s.tr("-", "_")
+        shared = I18n.t("logins.shared", default: {})
+        shared = shared.merge(I18n.t("logins.signing_up", default: {})) if signing_up
+        named = key.present? ? I18n.t("logins.#{key}", default: {}) : {}
+
+        shared.merge(named.is_a?(Hash) ? named : {}).transform_keys(&:to_s)
+      end
+
+      def as_json(*)
+        @as_json ||= build_json
+      end
+
+      def client_json
+        return nil if client.nil?
+
+        {
+          "name" => client.name,
+          "id" => client.client_id,
+          "logo" => client.logo_url(actor),
+          "site" => client.link(:client_uri),
+          "terms" => client.link(:tos_uri),
+          "privacy" => client.link(:policy_uri),
+          "returnsTo" => SectorIdentifier.host(request.redirect_uri)
+        }.compact
+      end
+
+      private
+
+        def organization_named(key)
+          return nil if key.blank?
+
+          @organizations ||= {}
+          @organizations.fetch(key) { @organizations[key] = Organization.active.find_by(key: key) }
+        end
+
+        def build_json
+          base = {
+            "prompt" => prompt,
+            "settled" => settled?,
+            "copy" => copy,
+            "warnings" => warnings,
+            "messages" => messages,
+            "identifier" => identifier,
+            "rid" => rid,
+            "docs" => ::Rails.configuration.masks.docs_url,
+            "actor" => actor && { "nickname" => actor.nickname, "name" => actor.name,
+                                  "identifier" => actor.identifier },
+            "person" => person_json,
+            "client" => client_json,
+            "tenant" => tenant && {
+              "name" => tenant.name, "logo" => tenant.logo_url
+            }.compact,
+            "signingUp" => signing_up,
+            "surface" => surface
+          }
+
+          answering.reduce(base) { |json, state| state.enabled? ? json.merge(state.as_json) : json }
+        end
+
+        def person_json
+          return nil if actor.nil? || authenticated_at.nil?
+
+          actor.person_json
+        end
+
+        def forget_vanished_actor!
+          return if store["actor_id"].blank? || actor.present?
+
+          store.replace({})
+          remove_instance_variable(:@actor) if defined?(@actor)
+        end
+
+        def stamp(key, field)
+          value = store["factors"]&.dig(key.to_s, field)
+          return nil if value.blank?
+
+          Time.iso8601(value)
+        rescue ArgumentError
+          nil
+        end
+
+        def states
+          states_by_key.values
+        end
+
+        def answering
+          return states if @prompting.nil?
+
+          states.take(states.index(@prompting) + 1)
+        end
+
+        def states_by_key
+          @states_by_key ||= STATES.index_by(&:key).transform_values { |cls| cls.new(self) }
+        end
+    end
+  end
+end

data/app/models/masks/server/logout.rb

@@ -0,0 +1,99 @@
+module Masks
+  module Server
+    class Logout
+      class Refused < StandardError
+        attr_reader :code
+
+        def initialize(code, message)
+          super(message)
+          @code = code
+        end
+      end
+
+      attr_reader :state, :redirect_uri
+
+      def initialize(issuer:, id_token_hint: nil, client_id: nil, post_logout_redirect_uri: nil, state: nil)
+        @issuer = issuer
+        @hint = id_token_hint.presence
+        @client_id = client_id.presence
+        @redirect_uri = post_logout_redirect_uri.presence
+        @state = state.presence
+
+        verify!
+      end
+
+      def client
+        @client ||= verified_client
+      end
+
+      def verified?
+        claims.present?
+      end
+
+      def redirect_to
+        return nil if redirect_uri.nil?
+        return redirect_uri if state.nil?
+
+        uri = URI.parse(redirect_uri)
+        uri.query = URI.encode_www_form(URI.decode_www_form(uri.query.to_s) << [ "state", state ])
+        uri.to_s
+      end
+
+      def subject
+        claims && claims["sub"]
+      end
+
+      def names?(actor)
+        return false if actor.nil? || subject.blank?
+
+        Subjects.locate(subject)&.id == actor.id
+      end
+
+      private
+
+        def claims
+          return @claims if defined?(@claims)
+
+          @claims = @hint && decode(@hint)
+        end
+
+        def decode(token)
+          @issuer.verify(token, typ: "jwt", required: %w[iss aud], verify_expiration: false)
+        rescue JWT::DecodeError
+          raise Refused.new("invalid_request", "the id_token_hint is not a token this issuer signed")
+        end
+
+        def verified_client
+          named = claims ? Array(claims["aud"]).first : @client_id
+          return nil if named.blank?
+
+          Client.authenticating(named)
+        end
+
+        def verify!
+          return if redirect_uri.nil?
+
+          if client.nil?
+            raise Refused.new(
+              "invalid_request",
+              "a post_logout_redirect_uri needs an id_token_hint or a client_id to be checked against"
+            )
+          end
+
+          if claims.nil? && client.dynamic? && !client.approved?
+            raise Refused.new(
+              "invalid_request",
+              "a client nobody approved sends people back only with an id_token_hint"
+            )
+          end
+
+          return if client.post_logout_redirect_uris.include?(redirect_uri)
+
+          raise Refused.new(
+            "invalid_request",
+            "post_logout_redirect_uri is not registered for this client"
+          )
+        end
+    end
+  end
+end

data/app/models/masks/server/mail_previews.rb

@@ -0,0 +1,90 @@
+module Masks
+  module Server
+    module MailPreviews
+      Sender = Data.define(:from) do
+        def delivery_method = [ :test ]
+      end
+
+      Preview = Data.define(:key, :name, :journey, :heading, :subject, :from, :to, :html, :text)
+
+      class << self
+        def all(client: nil)
+          Current.set(previewing: true) do
+            entries(client).map { |key, name, journey, delivery| render(key, name, journey, delivery.message) }
+          end
+        end
+
+        private
+
+          def entries(client)
+            person = Actor.new(uuid: "preview", nickname: "sam", email: "sam@example.com", name: "Sam Rivera")
+            manager = Actor.new(uuid: "manager", nickname: "ada", email: "ada@example.com", name: "Ada Park")
+            signing_in = Journey.new(kind: Journey::SIGN_IN, via: Journey::AUTHORIZATION, client: client)
+            managing = Journey.manage(manager)
+            system = Journey.system
+            origin = signing_in.origin
+            due = IdleAccounts::WARNING.from_now
+            changed = Event.new(action: Event::PASSWORD_CHANGED, actor: person, created_at: Time.current,
+                                ip_address: "203.0.113.7")
+            acme = Organization.new(key: "acme", name: "Acme", roles: [ "billing" ])
+            joining = Membership.new(organization: acme, actor: person, role: "billing", invited_by: manager,
+                                     invited_as: person.email, pending: true)
+            promoted = Event.new(action: Event::MEMBERSHIP_ROLE_CHANGED, actor: person, by: manager, organization: acme,
+                                 created_at: Time.current, details: { "was" => "member", "now" => "owner" })
+
+            [
+              [ "confirmation_code", "Confirmation code", signing_in,
+                ActorMailer.confirmation_code(person.email, "482913", journey: signing_in) ],
+              [ "email_verification", "Email confirmation", signing_in,
+                ActorMailer.email_verification(person, "#{origin}/verify/preview", journey: signing_in) ],
+              [ "password_reset", "Password reset", signing_in,
+                ActorMailer.password_reset(person, "#{origin}/reset/preview", journey: signing_in) ],
+              [ "approval_requested", "Approval requested", signing_in,
+                ActorMailer.approval_requested(manager, person, journey: signing_in) ],
+              [ "recovery_requested", "Help signing in requested", signing_in,
+                ActorMailer.recovery_requested(manager, person, journey: signing_in) ],
+              [ "invitation", "Invitation", managing,
+                ActorMailer.invitation(person, "#{origin}/invite/preview", journey: managing) ],
+              [ "invitation_organization", "Invitation to an organization", managing,
+                ActorMailer.invitation(person, "#{origin}/invite/preview", journey: managing, membership: joining) ],
+              [ "organization_invitation", "Added to an organization", managing,
+                ActorMailer.organization_invitation(joining, journey: managing) ],
+              [ "approved", "Account approved", managing,
+                ActorMailer.approved(person, journey: managing) ],
+              [ "notification", "Security notice", system,
+                ActorMailer.notification(person, changed, journey: system) ],
+              [ "notification_organization", "Organization role changed", system,
+                ActorMailer.notification(person, promoted, journey: system) ],
+              [ "idle_suspend", "Idle, before suspension", system,
+                ActorMailer.idle(person, due: due, notice: IdleAccounts::SUSPEND, journey: system) ],
+              [ "idle_delete", "Idle, before deletion", system,
+                ActorMailer.idle(person, due: due, notice: IdleAccounts::DELETE, journey: system) ],
+              [ "idle_delete_suspended", "Idle and suspended, before deletion", system,
+                ActorMailer.idle(person, due: due, notice: IdleAccounts::DELETE_SUSPENDED, journey: system) ],
+              [ "sender_trial", "Mail sender test", managing,
+                SenderMailer.trial(manager.email, sender: Sender.new(from: ApplicationMailer.from), journey: managing) ]
+            ]
+          end
+
+          def render(key, name, journey, message)
+            Preview.new(
+              key: key,
+              name: name,
+              journey: journey.kind,
+              heading: journey.heading.to_s,
+              subject: message.subject.to_s,
+              from: Array(message.from).join(", "),
+              to: Array(message.to).join(", "),
+              html: part(message, "text/html"),
+              text: part(message, "text/plain")
+            )
+          end
+
+          def part(message, type)
+            found = message.multipart? ? message.parts.find { |each| each.mime_type == type } : message
+            found&.mime_type == type ? found.decoded : nil
+          end
+      end
+    end
+  end
+end