masks-server 0.7.0

data/app/models/masks/server/mail_template.rb

@@ -0,0 +1,77 @@
+module Masks
+  module Server
+    class MailTemplate < ApplicationRecord
+      include TenantScoped
+
+      SIGNATURE = "signature".freeze
+      KINDS = {
+        "invitation" => %w[tenant name nickname organization],
+        "organization_invitation" => %w[tenant name nickname organization role],
+        "password_reset" => %w[tenant name nickname],
+        "email_verification" => %w[tenant name nickname],
+        "confirmation_code" => %w[tenant code],
+        "approval_requested" => %w[tenant nickname],
+        "recovery_requested" => %w[tenant nickname],
+        "approved" => %w[tenant name nickname],
+        SIGNATURE => %w[tenant]
+      }.freeze
+      SUBJECT_LIMIT = 150
+      MESSAGE_LIMIT = 2_000
+      PLACEHOLDER = /\{\{\s*([a-z_]+)\s*\}\}/
+
+      validates :kind, inclusion: { in: KINDS.keys }, uniqueness: { scope: :tenant_id }
+      validates :subject, length: { maximum: SUBJECT_LIMIT }
+      validates :message, length: { maximum: MESSAGE_LIMIT }
+      validate :signature_has_no_subject
+      validate :placeholders_are_known
+
+      normalizes :subject, with: ->(value) { value.to_s.squish.presence }
+      normalizes :message, with: ->(value) { value.to_s.gsub("\r\n", "\n").strip.presence }
+
+      class << self
+        def for(kind)
+          find_by(kind: kind.to_s)
+        end
+
+        def each_kind
+          held = all.index_by(&:kind)
+
+          KINDS.keys.map { |kind| held[kind] || new(kind: kind) }
+        end
+      end
+
+      def placeholders
+        KINDS.fetch(kind, [])
+      end
+
+      def subject_for(values)
+        subject && fill(subject, values).squish.presence
+      end
+
+      def paragraphs_for(values)
+        return nil if message.blank?
+
+        fill(message, values).split(/\n\s*\n/).map(&:strip).reject(&:empty?).presence
+      end
+
+      private
+
+        def fill(text, values)
+          text.gsub(PLACEHOLDER) { values.fetch(::Regexp.last_match(1).to_sym, "").to_s }
+        end
+
+        def signature_has_no_subject
+          errors.add(:subject, "is not used by the signature") if kind == SIGNATURE && subject.present?
+        end
+
+        def placeholders_are_known
+          [ subject, message ].compact.each do |text|
+            unknown = text.scan(PLACEHOLDER).flatten.uniq - placeholders
+            next if unknown.empty?
+
+            errors.add(:base, "{{#{unknown.join('}}, {{')}}} is not offered here; use #{placeholders.map { |name| "{{#{name}}}" }.join(', ')}")
+          end
+        end
+    end
+  end
+end

data/app/models/masks/server/manage_roles.rb

@@ -0,0 +1,48 @@
+module Masks
+  module Server
+    module ManageRoles
+      OWNER = Scopes::MANAGE
+      SECURITY = Scopes::MANAGE_SECURITY
+      SUPPORT = Scopes::MANAGE_SUPPORT
+      READ = Scopes::MANAGE_READ
+
+      SCOPES = [ OWNER, SECURITY, SUPPORT, READ ].freeze
+      OWNER_ONLY = [ *SCOPES, Scopes::SCIM ].freeze
+
+      LEVELS = {
+        read: SCOPES,
+        support: [ OWNER, SUPPORT ],
+        security: [ OWNER, SECURITY ],
+        owner: [ OWNER ]
+      }.freeze
+
+      class << self
+        def held(scopes)
+          Scopes.list(scopes) & SCOPES
+        end
+
+        def any?(scopes)
+          held(scopes).any?
+        end
+
+        def owner_only(scopes)
+          Scopes.list(scopes).select do |scope|
+            OWNER_ONLY.any? { |held| held == scope || Scopes.covered?([ scope ], held) }
+          end
+        end
+
+        def permits?(scopes, level)
+          LEVELS.fetch(level).intersect?(held(scopes))
+        end
+
+        def owner?(scopes)
+          permits?(scopes, :owner)
+        end
+
+        def levels(scopes)
+          LEVELS.keys.select { |level| permits?(scopes, level) }
+        end
+      end
+    end
+  end
+end

data/app/models/masks/server/master_key.rb

@@ -0,0 +1,44 @@
+module Masks
+  module Server
+    module MasterKey
+      class Mismatch < StandardError; end
+
+      class << self
+        def check!
+          Tenant.active.find_each do |tenant|
+            tenant.pairwise_salt
+            Tenant.switch(tenant) { SigningKey.find_each(&:private_pem) }
+          end
+        rescue ActiveRecord::Encryption::Errors::Decryption
+          raise Mismatch, "this server's encryption key cannot read the database's encrypted columns. Every " \
+                          "replica needs the same MASKS_MASTER_KEY, a restored database needs the key it was " \
+                          "backed up with, and a rotated key needs MASKS_PREVIOUS_MASTER_KEY until it is re-encrypted."
+        end
+
+        def reencrypt!(tenants = Tenant.all)
+          tenants.find_each do |tenant|
+            Tenant.switch(tenant) do
+              Tenant.transaction do
+                encrypted_models.each { |model| model.unscoped.find_each(&:encrypt) }
+                tenant.encrypt
+                tenant.update_columns(keys_derived_at: Time.current)
+              end
+            end
+          end
+        end
+
+        def underived
+          Tenant.where(keys_derived_at: nil)
+        end
+
+        def encrypted_models
+          ::Rails.application.eager_load!
+
+          ApplicationRecord.descendants.select do |model|
+            model.base_class == model && model != Tenant && model.encrypted_attributes.present?
+          end
+        end
+      end
+    end
+  end
+end

data/app/models/masks/server/members.rb

@@ -0,0 +1,166 @@
+module Masks
+  module Server
+    module Members
+      class Refused < StandardError; end
+
+      DAILY_INVITATIONS = 50
+      RESEND_AFTER = 1.hour
+      INVITED = [ Event::MEMBERSHIP_ADDED, Event::MEMBERSHIP_RESENT ].freeze
+      NOT_SENT = { delivered: false, url: nil }.freeze
+
+      class << self
+        def add!(organization:, role:, by:, journey:, actor: nil, email: nil, manager: false)
+          raise Refused, "#{organization.name} is archived" if organization.archived?
+
+          address = email.to_s.strip.downcase.presence
+          policy = SignInPolicy.for(organization: organization)
+
+          invitable!(organization, address, by: by, policy: policy) unless manager
+
+          actor ||= (address && Actor.find_by(email: address)) || invitee(address, by: by, policy: policy)
+
+          if organization.memberships.exists?(actor: actor)
+            raise Refused, "#{address || actor.identifier} is already a member of #{organization.name}"
+          end
+
+          membership = enroll!(organization, actor, role: role, by: by, pending: true, invited_as: address)
+
+          { membership: membership }.merge(deliver(membership, journey))
+        end
+
+        def enroll!(organization, actor, role:, by:, pending: false, invited_as: nil, provisioned: false, **details)
+          membership = organization.memberships.new(actor: actor, role: role, invited_by: by, pending: pending,
+                                                    invited_as: invited_as, provisioned: provisioned)
+
+          Membership.transaction do
+            raise Refused, membership.errors.full_messages.to_sentence unless membership.save
+
+            Event.record!(Event::MEMBERSHIP_ADDED, actor: actor, by: by, organization: organization, role: role, **details)
+          end
+
+          membership
+        end
+
+        def assign!(membership, role:, by:, **details)
+          organization = membership.organization
+          was = nil
+
+          organization.with_lock do
+            membership.reload
+            was = membership.role
+
+            next if was == role
+
+            membership.role = role
+
+            raise Refused, membership.errors.full_messages.to_sentence unless membership.save
+
+            AccessToken.live.where(organization: organization, actor: membership.actor).find_each(&:revoke!)
+            Event.record!(Event::MEMBERSHIP_ROLE_CHANGED, actor: membership.actor, by: by,
+                                                          organization: organization, was: was, now: role, **details)
+          end
+
+          membership
+        end
+
+        def remove!(membership, by:)
+          organization = membership.organization
+
+          organization.with_lock do
+            raise Refused, membership.errors.full_messages.to_sentence unless membership.destroy
+
+            Token.live.where(organization: organization, actor: membership.actor).find_each(&:revoke!)
+            Event.record!(Event::MEMBERSHIP_REMOVED, actor: membership.actor, by: by,
+                                                     organization: organization, role: membership.role)
+          end
+
+          membership
+        end
+
+        def resend!(membership, by:, journey:, manager: false)
+          organization = membership.organization
+
+          raise Refused, "#{label(membership) || 'that person'} has already joined #{organization.name}" unless membership.pending?
+          raise Refused, "#{organization.name} is archived" if organization.archived?
+          raise Refused, "that invitation was sent less than an hour ago" if membership.invited_at&.after?(RESEND_AFTER.ago)
+
+          capped!(by) unless manager
+
+          membership.update!(invited_at: Time.current)
+          Event.record!(Event::MEMBERSHIP_RESENT, actor: membership.actor, by: by, organization: organization,
+                                                  role: membership.role)
+
+          { membership: membership }.merge(deliver(membership, journey))
+        end
+
+        def purge_lapsed!
+          Membership.lapsed.includes(:organization, :actor).find_each do |membership|
+            membership.destroy!
+            Event.record!(Event::MEMBERSHIP_EXPIRED, actor: membership.actor, by: nil, organization: membership.organization,
+                                                     role: membership.role, invited_as: membership.invited_as)
+          end
+        end
+
+        def label(membership)
+          membership.pending? ? membership.invited_as : membership.actor.identifier
+        end
+
+        private
+
+          def invitable!(organization, address, by:, policy:)
+            raise Refused, "an email address is required" if address.nil?
+
+            capped!(by)
+
+            return if proven?(organization, address)
+            return if policy.signup && policy.admits?(address)
+
+            raise Refused, "#{organization.name} can add people at a domain it has proven, or anyone while sign-up is open; " \
+                           "ask a manager to add #{address}"
+          end
+
+          def capped!(by)
+            return if Event.where(action: INVITED, by: by, created_at: 1.day.ago..).count < DAILY_INVITATIONS
+
+            raise Refused, "you have sent #{DAILY_INVITATIONS} invitations today; a manager can add more"
+          end
+
+          def proven?(organization, address)
+            DomainClaim.for_email(address)&.provider&.organization_id == organization.id
+          end
+
+          def invitee(email, by:, policy:)
+            raise Refused, "an email address is required" if email.blank?
+
+            actor = Actor.new(email: email, scopes: Scopes.join(policy.signup_scope_list))
+
+            raise Refused, actor.errors.full_messages.to_sentence unless actor.save
+
+            Event.record!(Event::ACTOR_CREATED, actor: actor, by: by, scopes: actor.scope_list, invited: true)
+
+            actor
+          end
+
+          def deliver(membership, journey)
+            membership.actor.activated? ? tell(membership, journey) : invite(membership, journey)
+          end
+
+          def invite(membership, journey)
+            return NOT_SENT if membership.actor.email.blank?
+
+            Invitations.open(actor: membership.actor, journey: journey, membership: membership).slice(:delivered, :url)
+          rescue Invitation::Refused
+            NOT_SENT
+          end
+
+          def tell(membership, journey)
+            return NOT_SENT unless Notifications.mailable?(membership.actor) && membership.acceptable?
+
+            ActorMailer.organization_invitation(membership, journey: journey).deliver_later
+
+            { delivered: true, url: nil }
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/membership.rb

@@ -0,0 +1,105 @@
+module Masks
+  module Server
+    class Membership < ApplicationRecord
+      class Unconfirmed < StandardError; end
+      class Expired < StandardError; end
+
+      include TenantScoped
+
+      belongs_to :organization
+      belongs_to :actor
+      belongs_to :invited_by, class_name: "Actor", optional: true
+
+      scope :accepted, -> { where(pending: false) }
+      scope :invitations, -> { where(pending: true) }
+      scope :lapsed, -> { invitations.where(invited_at: ...(lifetime * 2).ago) }
+      scope :outstanding, -> { invitations.where(invited_at: lifetime.ago..) }
+      scope :live, -> { accepted.joins(:organization).merge(Organization.active).includes(:organization).order("organizations.name") }
+
+      before_create { self.invited_at ||= Time.current if pending? }
+
+      def self.lifetime
+        ::Rails.configuration.masks.organization_invitation_lifetime
+      end
+
+      normalizes :external_id, with: Actor::EXTERNAL_ID
+
+      validates :actor_id, uniqueness: { scope: :organization_id }
+      validate :role_is_offered
+      validate :an_owner_remains, on: :update
+
+      before_destroy :keep_an_owner
+
+      def owner?
+        role == Organization::OWNER && !pending?
+      end
+
+      def expires_at
+        invited_at + self.class.lifetime if pending?
+      end
+
+      def expired?
+        expires_at.present? && expires_at <= Time.current
+      end
+
+      def addressed_to?(someone)
+        invited_as.blank? || someone.email.to_s.casecmp?(invited_as)
+      end
+
+      def acceptable?
+        return true if invited_as.blank?
+
+        addressed_to?(actor) && actor.email_verified_at.present?
+      end
+
+      def claim
+        { "id" => organization.uuid, "key" => organization.key, "name" => organization.name, "role" => role }
+      end
+
+      def accept!(vouched: false)
+        return self unless pending?
+
+        unless vouched
+          raise Expired, "this invitation to #{organization.name} has expired" if expired?
+          raise Unconfirmed, "confirm #{invited_as} before accepting" unless acceptable?
+        end
+
+        update!(pending: false)
+        Event.record!(Event::MEMBERSHIP_ACCEPTED, actor: actor, organization: organization, role: role)
+
+        self
+      end
+
+      private
+
+        def role_is_offered
+          errors.add(:role, "is not one #{organization&.name} offers") unless organization&.role?(role)
+        end
+
+        def an_owner_remains
+          return unless role_changed? && role_was == Organization::OWNER
+          return if pending_in_database || others_own?
+
+          errors.add(:role, "cannot change, because #{organization.name} needs an owner")
+        end
+
+        def keep_an_owner
+          return if role_in_database != Organization::OWNER || pending_in_database || others_own?
+          return ownerless! if destroyed_by_association
+
+          errors.add(:base, "#{organization.name} needs an owner")
+          throw :abort
+        end
+
+        def ownerless!
+          return unless destroyed_by_association.active_record <= Actor
+
+          Event.record!(Event::ORGANIZATION_OWNERLESS, actor: nil, by: nil, organization: organization)
+        end
+
+        def others_own?
+          organization.memberships.accepted.where(role: Organization::OWNER).where.not(id: id).exists?
+        end
+    end
+  end
+end

data/app/models/masks/server/namespace.rb

@@ -0,0 +1,85 @@
+module Masks
+  module Server
+    class Namespace < ApplicationRecord
+      include TenantScoped
+
+      class Taken < StandardError; end
+
+      belongs_to :client, optional: true
+
+      validates :name, presence: true, uniqueness: { scope: :tenant_id }
+      validates :resource, presence: true
+      validate :name_is_a_prefix
+      validate :name_is_not_reserved
+
+      class << self
+        def prefixes(scopes)
+          Scopes.list(scopes).select { |scope| Scopes.prefix?(scope) && !scope.start_with?(Scopes::NAMESPACE) }
+        end
+
+        def named(scopes)
+          where(name: prefixes(scopes))
+        end
+
+        def taken(handshake)
+          named(handshake.scopes).where.not(resource: handshake.resource.to_s)
+        end
+
+        def refusal(handshake)
+          held = taken(handshake)
+          return nil if held.empty?
+
+          held.map { |row| "#{row.name} is claimed by #{row.resource}" }.join(", ")
+        end
+
+        def claim!(handshake, client:, actor: nil)
+          names = prefixes(handshake.scopes)
+          return [] if names.empty?
+
+          transaction do
+            raise Taken, refusal(handshake) if taken(handshake).exists?
+
+            claimed = names.map do |name|
+              row = find_or_initialize_by(name: name)
+
+              row.assign_attributes(
+                client: client,
+                resource: handshake.resource,
+                claimed_at: Time.current
+              )
+
+              row.save!
+              row
+            end
+
+            actor&.grant!(names)
+
+            claimed
+          end
+        end
+      end
+
+      def releasable?
+        client.nil? || client.archived_at.present?
+      end
+
+      def release!
+        destroy!
+      end
+
+      private
+
+        def name_is_a_prefix
+          return if Scopes.prefix?(name)
+
+          errors.add(:name, "must end in a colon")
+        end
+
+        def name_is_not_reserved
+          return unless name.to_s == Scopes::NAMESPACE
+
+          errors.add(:name, "belongs to this issuer")
+        end
+    end
+  end
+end

data/app/models/masks/server/notifications.rb

@@ -0,0 +1,156 @@
+module Masks
+  module Server
+    module Notifications
+      GROUPS = {
+        "password" => [
+          Event::PASSWORD_CHANGED,
+          Event::PASSWORD_RESET_COMPLETED
+        ],
+        "factors" => [
+          Event::PASSKEY_ADDED,
+          Event::PASSKEY_REMOVED,
+          Event::BACKUP_CODES_GENERATED,
+          Event::BACKUP_CODE_SPENT,
+          Event::AUTHENTICATOR_ENABLED,
+          Event::AUTHENTICATOR_DISABLED,
+          Event::EMAIL_CODES_ENABLED,
+          Event::EMAIL_CODES_DISABLED,
+          Event::TEXT_CODES_ENABLED,
+          Event::TEXT_CODES_DISABLED,
+          Event::RECOVERY_REQUESTED,
+          Event::SECOND_FACTORS_RESET
+        ],
+        "sessions" => [
+          Event::SESSION_STARTED,
+          Event::SESSION_REVOKED,
+          Event::SIGN_IN_RISKY,
+          Event::DEVICE_BLOCKED
+        ],
+        "applications" => [
+          Event::CONSENT_GRANTED,
+          Event::CONNECTION_LINKED,
+          Event::CONNECTION_UNLINKED,
+          Event::DEVICE_CODE_APPROVED
+        ],
+        "account" => [
+          Event::PHONE_CHANGED,
+          Event::PHONE_REMOVED,
+          Event::ACTOR_SCOPES_CHANGED,
+          Event::ACCOUNT_EXPORTED
+        ],
+        "organizations" => [
+          Event::MEMBERSHIP_ROLE_CHANGED,
+          Event::MEMBERSHIP_REMOVED,
+          Event::MEMBERSHIP_SUSPENDED
+        ]
+      }.freeze
+
+      SELF_EVIDENT = GROUPS["organizations"]
+
+      WARNS_PREVIOUS = [ Event::EMAIL_CHANGED ].freeze
+
+      MAILED = GROUPS.values.flatten.freeze
+
+      ONCE_PER_DEVICE = [ Event::SESSION_STARTED ].freeze
+
+      class << self
+        def mailed?(action)
+          MAILED.include?(action.to_s)
+        end
+
+        def raised(event)
+          return false unless mailed?(event.action) || WARNS_PREVIOUS.include?(event.action)
+          return false unless event.actor_id && ActorMailer.deliverable?
+
+          NotificationJob.perform_later(event.id, origin: Current.origin)
+          true
+        end
+
+        def deliver(event)
+          return warn_previous(event) if WARNS_PREVIOUS.include?(event.action)
+
+          actor = event.actor
+
+          return false unless mailable?(actor)
+          return false unless actor.notified?(event.action)
+          return false unless worth_saying?(event)
+
+          ActorMailer.notification(actor, event, journey: Journey.new(kind: Journey::SYSTEM, client: event.client)).deliver_now
+
+          true
+        end
+
+        def mailable?(actor)
+          ActorMailer.deliverable? &&
+            actor.present? &&
+            actor.activated? &&
+            actor.email.present? &&
+            actor.email_verified_at.present?
+        end
+
+        def worth_saying?(event)
+          return false if SELF_EVIDENT.include?(event.action) && event.by_id == event.actor_id
+          return true unless ONCE_PER_DEVICE.include?(event.action)
+          return true if event.device_id.nil?
+
+          !Event.where(actor_id: event.actor_id, device_id: event.device_id, action: event.action)
+                .where("id < ?", event.id)
+                .exists?
+        end
+
+        def said(event)
+          I18n.t("events.actions.#{event.action}", default: event.action)
+        end
+
+        def told(event, tenant_name)
+          {
+            tenant: tenant_name,
+            nickname: event.actor&.identifier,
+            client: event.client&.name,
+            device: event.device&.label,
+            by: event.by&.identifier,
+            provider: provider_name(event),
+            remaining: detail(event, "remaining"),
+            passkey: detail(event, "passkey"),
+            organization: event.organization&.name,
+            role: detail(event, "now") || detail(event, "role"),
+            was: detail(event, "was")
+          }
+        end
+
+        def where(event)
+          [ event.device&.label, event.ip_address ].compact_blank.join(" · ")
+        end
+
+        def at(event, actor)
+          zone = ActiveSupport::TimeZone[actor.zoneinfo.to_s] || ActiveSupport::TimeZone["UTC"]
+
+          event.created_at.in_time_zone(zone)
+        end
+
+        private
+
+          def warn_previous(event)
+            previous = detail(event, "previous")
+
+            return false if previous.blank? || event.actor.nil? || !ActorMailer.deliverable?
+
+            journey = Journey.new(kind: Journey::SYSTEM, client: event.client)
+            ActorMailer.notification(event.actor, event, journey: journey, to: previous).deliver_now
+
+            true
+          end
+
+          def detail(event, key)
+            (event.details || {})[key]
+          end
+
+          def provider_name(event)
+            key = detail(event, "provider")
+
+            key.presence && (Provider.find_by(key: key)&.name || key)
+          end
+      end
+    end
+  end
+end