masks-server 0.7.0

data/app/models/masks/server/organization.rb

@@ -0,0 +1,74 @@
+module Masks
+  module Server
+    class Organization < ApplicationRecord
+      include TenantScoped
+      include Archivable
+
+      OWNER = "owner".freeze
+      MEMBER = "member".freeze
+      BUILT_IN = [ OWNER, MEMBER ].freeze
+      ROLE = /\A[a-z0-9][a-z0-9_-]{0,39}\z/
+      CLAIM = "org".freeze
+
+      has_many :memberships, dependent: :destroy
+      has_many :actors, -> { merge(Membership.accepted) }, through: :memberships
+      has_many :tokens, dependent: :destroy
+      has_many :providers, dependent: :destroy
+
+      belongs_to :sign_in_policy, optional: true
+
+      validates :key, presence: true,
+                      uniqueness: { scope: :tenant_id },
+                      format: { with: /\A[a-z0-9][a-z0-9-]*\z/ }
+      validates :name, presence: true
+      validate :roles_are_named
+      validate :roles_still_held, on: :update, if: :roles_changed?
+
+      normalizes :roles, with: ->(held) { Array(held).map { |role| role.to_s.strip.downcase }.reject(&:empty?).uniq - BUILT_IN }
+
+      def role_list
+        BUILT_IN + roles
+      end
+
+      def role?(role)
+        role_list.include?(role.to_s)
+      end
+
+      def membership_for(actor)
+        return nil if actor.nil? || archived?
+
+        memberships.accepted.find_by(actor: actor)
+      end
+
+      def claim_for(actor)
+        membership_for(actor)&.claim
+      end
+
+      def archive!(by: nil)
+        transaction do
+          update!(archived_at: Time.current)
+          held = tokens.live.where.not(actor_id: nil).distinct.pluck(:actor_id)
+          tokens.live.find_each(&:revoke!)
+
+          Actor.where(id: held).find_each do |actor|
+            Event.record!(Event::MEMBERSHIP_SUSPENDED, actor: actor, by: by, organization: self)
+          end
+        end
+      end
+
+      private
+
+        def roles_are_named
+          unnamed = roles.reject { |role| role.match?(ROLE) }
+
+          errors.add(:roles, "must be lowercase letters, digits, dashes, and underscores: #{unnamed.join(', ')}") if unnamed.any?
+        end
+
+        def roles_still_held
+          held = memberships.where.not(role: role_list).distinct.pluck(:role)
+
+          errors.add(:base, :held, message: "members still hold #{held.join(', ')}") if held.any?
+        end
+    end
+  end
+end

data/app/models/masks/server/outbound.rb

@@ -0,0 +1,165 @@
+module Masks
+  module Server
+    module Outbound
+      OPEN_TIMEOUT = 5
+      READ_TIMEOUT = 10
+      DEADLINE = 20
+      CEILING = 256.kilobytes
+
+      UNROUTABLE = %w[
+        0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 127.0.0.0/8 169.254.0.0/16
+        172.16.0.0/12 192.0.0.0/24 192.0.2.0/24 192.168.0.0/16 198.18.0.0/15
+        198.51.100.0/24 203.0.113.0/24 224.0.0.0/4 240.0.0.0/4
+        ::/96 ::1/128 64:ff9b::/96 64:ff9b:1::/48 100::/64 2002::/16 fc00::/7 fe80::/10 ff00::/8
+      ].map { |range| IPAddr.new(range) }.freeze
+
+      class Overflow < StandardError; end
+      class Refused < StandardError; end
+      class Slow < StandardError; end
+
+      UNREADABLE = [
+        Slow, Net::HTTPBadResponse, Net::OpenTimeout, Net::ReadTimeout, Net::WriteTimeout, SocketError, SystemCallError,
+        OpenSSL::SSL::SSLError, EOFError, IOError, Zlib::Error
+      ].freeze
+
+      class << self
+        def problem_with(url)
+          uri = URI.parse(url.to_s)
+          secure = uri.is_a?(URI::HTTPS) || (::Rails.env.local? && uri.is_a?(URI::HTTP))
+
+          if !secure || uri.host.blank?
+            "must be an https address"
+          elsif uri.userinfo.present?
+            "must not carry a username or password"
+          elsif !::Rails.env.local? && !routable?(uri)
+            "must resolve to a public address"
+          end
+        rescue URI::InvalidURIError
+          "is not an address"
+        end
+
+        def routable?(uri)
+          vetted(uri).present?
+        end
+
+        def vetted(uri)
+          return nil unless uri.is_a?(URI::HTTP)
+
+          public_address(uri.hostname, uri.port)
+        end
+
+        def public_address(host, port)
+          addresses = resolve(host, port)
+
+          return nil if addresses.empty? || addresses.any? { |address| unroutable?(address) }
+
+          addresses.first
+        end
+
+        def resolve(host, port)
+          return [] if host.blank?
+
+          Addrinfo.getaddrinfo(host.to_s, port, nil, :STREAM).map do |info|
+            held = IPAddr.new(info.ip_address.split("%").first)
+
+            held.ipv4_mapped? ? held.native : held
+          end
+        rescue SocketError
+          []
+        end
+
+        def unroutable?(address)
+          UNROUTABLE.any? { |range| range.include?(address) } && allowed.none? { |range| range.include?(address) }
+        end
+
+        def allowed
+          Server.config.outbound_allowed || []
+        end
+
+        def fetch!(uri, **options)
+          get!(uri, **options).body
+        end
+
+        def get!(uri, open: OPEN_TIMEOUT, read: READ_TIMEOUT, ceiling: CEILING, within: nil, headers: {})
+          response = request!(uri, Net::HTTP::Get.new(uri, headers), open: open, read: read,
+                                                                    ceiling: ceiling + 1, within: within)
+
+          raise Refused, "answered #{response.code}" unless response.is_a?(Net::HTTPSuccess)
+          raise Refused, "answered with more than #{ceiling / 1.kilobyte}KB" if response.body.bytesize > ceiling
+
+          response
+        rescue Slow
+          raise Refused, "took longer than #{within || DEADLINE} seconds to answer"
+        rescue *UNREADABLE => e
+          raise Refused, "could not be read: #{e.class}"
+        end
+
+        def request!(uri, request, open: OPEN_TIMEOUT, read: READ_TIMEOUT, ceiling: CEILING, within: nil)
+          call(uri, request, open: open, read: read, address: pinned!(uri), ceiling: ceiling, within: within)
+        end
+
+        def post(uri, form, open: OPEN_TIMEOUT, read: READ_TIMEOUT, address: nil)
+          request = Net::HTTP::Post.new(uri, "Content-Type" => "application/x-www-form-urlencoded")
+          request.body = URI.encode_www_form(form)
+
+          call(uri, request, open: open, read: read, address: address || pinned!(uri))
+        end
+
+        def post_json(uri, body, headers: {}, open: OPEN_TIMEOUT, read: READ_TIMEOUT, address: nil)
+          request = Net::HTTP::Post.new(uri, { "Content-Type" => "application/json" }.merge(headers))
+          request.body = body
+
+          call(uri, request, open: open, read: read, address: address || pinned!(uri))
+        end
+
+        def pinned!(uri)
+          return nil if ::Rails.env.local?
+
+          vetted(uri) || raise(Refused, "resolves to an address this server will not call")
+        end
+
+        def call(uri, request, open:, read:, address: nil, ceiling: CEILING, within: nil)
+          kept = +""
+          answered = nil
+
+          begin
+            Timeout.timeout(within || DEADLINE, Slow) do
+              connection(uri, open: open, read: read, address: address).start do |http|
+                http.request(request) do |response|
+                  answered = response
+
+                  response.read_body do |chunk|
+                    kept << chunk
+                    raise Overflow if kept.bytesize > ceiling
+                  end
+                end
+              end
+            end
+          rescue Overflow
+            answered.instance_variable_set(:@read, true)
+          end
+
+          answered.body = kept.byteslice(0, ceiling)
+          answered
+        end
+
+        def body(response)
+          response.body.to_s.byteslice(0, CEILING)
+        end
+
+        private
+
+          def connection(uri, open:, read:, address:)
+            http = Net::HTTP.new(uri.hostname, uri.port)
+            http.ipaddr = address.to_s if address
+            http.use_ssl = uri.scheme == "https"
+            http.open_timeout = open
+            http.read_timeout = read
+            http.max_retries = 0
+
+            http
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/passkey.rb

@@ -0,0 +1,83 @@
+module Masks
+  module Server
+    class Passkey < ApplicationRecord
+      include TenantScoped
+
+      MAX_PER_ACTOR = 20
+      SIGN_COUNT_CEILING = (2**32) - 1
+
+      belongs_to :actor
+      belongs_to :authenticator, primary_key: :aaguid, foreign_key: :aaguid, optional: true
+
+      validates :external_id, :public_key, presence: true
+      NAME_LIMIT = 64
+
+      validates :name, length: { maximum: NAME_LIMIT }
+      normalizes :name, with: ->(value) { value.to_s.strip.presence }
+      validates :external_id, uniqueness: { scope: :tenant_id }
+      validates :sign_count, numericality: {
+        only_integer: true, greater_than_or_equal_to: 0, less_than_or_equal_to: SIGN_COUNT_CEILING
+      }
+
+      scope :newest_first, -> { order(created_at: :desc) }
+      scope :discoverable, -> { where(discoverable: true) }
+
+      def self.enrol!(actor:, credential:, name:)
+        create!(
+          actor: actor,
+          name: name,
+          external_id: credential.id,
+          public_key: credential.public_key,
+          sign_count: credential.sign_count,
+          aaguid: aaguid_of(credential),
+          discoverable: !!credential.response&.authenticator_data&.user_verified?,
+          user_verified: !!credential.response&.authenticator_data&.user_verified?
+        )
+      end
+
+      def self.crowded?(actor)
+        where(actor_id: actor.id).count >= MAX_PER_ACTOR
+      end
+
+      def self.register!(actor:, credential:, name: nil)
+        enrol!(actor: actor, credential: credential, name: name).tap do |passkey|
+          Event.record!(Event::PASSKEY_ADDED, actor: actor, passkey: passkey.name)
+        end
+      end
+
+      def self.aaguid_of(credential)
+        credential.response&.attestation_object&.authenticator_data&.attested_credential_data&.aaguid
+      rescue StandardError
+        nil
+      end
+
+      def used!(sign_count, user_verified:)
+        update!(
+          sign_count: [ sign_count.to_i, self.sign_count ].max,
+          user_verified: user_verified,
+          last_used_at: Time.current
+        )
+      end
+
+      def label
+        name.presence || authenticator&.name.presence || "Passkey"
+      end
+
+      def icon
+        authenticator&.icon
+      end
+
+      def compromised?
+        authenticator&.compromised? || false
+      end
+
+      def compromise
+        authenticator&.compromise
+      end
+
+      def cloned?(reported)
+        reported.to_i.positive? && sign_count.positive? && reported.to_i <= sign_count
+      end
+    end
+  end
+end

data/app/models/masks/server/password_reset.rb

@@ -0,0 +1,30 @@
+module Masks
+  module Server
+    class PasswordReset < Token
+      include MailedLink
+
+      path "reset"
+
+      def self.lifetime
+        ::Rails.configuration.masks.password_reset_lifetime
+      end
+
+      def self.settle!(secret, password)
+        claimed = claim(secret)
+        return nil if claimed.nil?
+
+        actor = claimed.actor
+        verifying = claimed.delivered? && claimed.addressed?
+        claiming = verifying && actor.email_unconfirmed?
+
+        transaction do
+          actor.reset_password!(password, verifying_email: verifying)
+          CodeFactors.disable!(actor, "email", by: nil) if claimed.delivered?
+          actor.forget_unproven_ways_in! if claiming
+        end
+
+        actor
+      end
+    end
+  end
+end

data/app/models/masks/server/passwords.rb

@@ -0,0 +1,21 @@
+module Masks
+  module Server
+    module Passwords
+      COMMON = Set.new(File.foreach(Engine.root.join("config/passwords/common.txt"), chomp: true)).freeze
+
+      class << self
+        def common?(password)
+          COMMON.include?(password.to_s.downcase)
+        end
+
+        def refusal(password, policy)
+          return "short-password" if password.to_s.length < policy.password_minimum
+          return "common-password" if policy.refuse_common_passwords && common?(password)
+          return "breached-password" if policy.refuse_breached_passwords && BreachedPasswords.breached?(password)
+
+          nil
+        end
+      end
+    end
+  end
+end

data/app/models/masks/server/pending_handshake.rb

@@ -0,0 +1,36 @@
+module Masks
+  module Server
+    class PendingHandshake < Token
+      def self.lifetime
+        1.hour
+      end
+
+      def self.answered_is_final?
+        false
+      end
+
+      def self.open!(handshake)
+        mint!(
+          scopes: Scopes.join(handshake.scopes),
+          audience: [ handshake.resource ],
+          redirect_uri: handshake.return_to,
+          payload: {
+            "name" => handshake.name,
+            "redirect_uris" => handshake.redirect_uris,
+            "state" => handshake.state,
+            "auth_method" => handshake.auth_method,
+            "backchannel_logout_uri" => handshake.backchannel_logout_uri
+          }.compact
+        )
+      end
+
+      def handshake
+        @handshake ||= Handshake.from_row(self)
+      end
+
+      def fingerprint
+        handshake.fingerprint
+      end
+    end
+  end
+end

data/app/models/masks/server/pending_login.rb

@@ -0,0 +1,23 @@
+module Masks
+  module Server
+    class PendingLogin < Token
+      def self.lifetime
+        1.day
+      end
+
+      def self.open!(store)
+        mint!(payload: store)
+      end
+
+      def store
+        @store ||= (payload || {}).deep_dup
+      end
+
+      def keep!(held)
+        return if held == payload && expires_at > (self.class.lifetime / 2).from_now
+
+        update_columns(payload: held, expires_at: self.class.lifetime.from_now, updated_at: Time.current)
+      end
+    end
+  end
+end

data/app/models/masks/server/pending_request.rb

@@ -0,0 +1,69 @@
+module Masks
+  module Server
+    class PendingRequest < Token
+      include CarriesAuthorization
+
+      def self.lifetime
+        1.hour
+      end
+
+      def self.answered_is_final?
+        true
+      end
+
+      def self.open!(authorization)
+        mint!(**attributes_for(authorization))
+      end
+
+      def fingerprint
+        authorization.fingerprint
+      end
+
+      def reauthenticate?
+        authorization.reauthenticate?
+      end
+
+      def multi_factor?
+        authorization.multi_factor?
+      end
+
+      def consent?
+        authorization.consent?
+      end
+
+      def silent?
+        authorization.silent?
+      end
+
+      def max_age
+        held("max_age")
+      end
+
+      def issue_code!(actor:, device: nil, session: nil, authenticated_at: nil, amr: nil, organization: nil)
+        AuthorizationCode.mint!(
+          organization: organization,
+          actor: actor,
+          device: device,
+          session: session,
+          parent: self,
+          authenticated_at: authenticated_at,
+          payload: { "amr" => Array(amr) },
+          client: client,
+          jkt: jkt,
+          scopes: Scopes.join(scopes_for(actor)),
+          audience: audience,
+          redirect_uri: redirect_uri,
+          requested_claims: requested_claims,
+          authorization_details: authorization_details,
+          nonce: nonce,
+          code_challenge: code_challenge,
+          code_challenge_method: code_challenge_method
+        )
+      end
+
+      def issued
+        children.find_by(kind: AuthorizationCode.sti_name)
+      end
+    end
+  end
+end

data/app/models/masks/server/pictures.rb

@@ -0,0 +1,84 @@
+module Masks
+  module Server
+    module Pictures
+      class Unreadable < StandardError; end
+
+      CONTENT_TYPE = "image/webp".freeze
+      QUALITY = 82
+      PIXELS = 100_000_000
+
+      MAGIC = {
+        "\x89PNG\r\n\x1a\n".b => "image/png",
+        "\xFF\xD8\xFF".b => "image/jpeg",
+        "GIF87a".b => "image/gif",
+        "GIF89a".b => "image/gif"
+      }.freeze
+
+      RIFF = "RIFF".b
+      WEBP = "WEBP".b
+
+      LOADERS = %w[
+        VipsForeignLoadPngBuffer VipsForeignLoadJpegBuffer VipsForeignLoadNsgifBuffer VipsForeignLoadWebpBuffer
+      ].freeze
+
+      class << self
+        def digest(bytes)
+          Digest::SHA256.hexdigest(bytes)[0, 16]
+        end
+
+        def sniff(bytes)
+          head = bytes.to_s.b
+
+          return "image/webp" if head.start_with?(RIFF) && head[8, 4] == WEBP
+
+          MAGIC.find { |magic, _| head.start_with?(magic) }&.last
+        end
+
+        def square(bytes, size)
+          refuse_a_bomb(bytes)
+          thumbnail(bytes, size)
+        rescue Vips::Error => e
+          raise Unreadable, e.message
+        end
+
+        def resized(data, digest, size, stored:, kind:)
+          return data if size.nil? || size >= stored
+
+          ::Rails.cache.fetch([ kind, digest, size ], expires_in: 1.day) { thumbnail(data, size) }
+        end
+
+        private
+
+          def images
+            require "vips"
+
+            confine_loaders
+
+            Vips::Image
+          end
+
+          def confine_loaders
+            return if @confined
+
+            Vips.block("VipsForeignLoad", true)
+            LOADERS.each { |loader| Vips.block(loader, false) }
+
+            @confined = true
+          end
+
+          def thumbnail(bytes, size)
+            images.thumbnail_buffer(bytes, size, height: size, size: :both, crop: :attention)
+                  .webpsave_buffer(Q: QUALITY, strip: true)
+          end
+
+          def refuse_a_bomb(bytes)
+            header = images.new_from_buffer(bytes, "", access: :sequential)
+
+            return if header.width.to_i * header.height.to_i <= PIXELS
+
+            raise Unreadable, "that image has too many pixels to resize"
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/presented_token.rb

@@ -0,0 +1,106 @@
+module Masks
+  module Server
+    class PresentedToken
+      ACCESS_TOKEN = "urn:ietf:params:oauth:token-type:access_token".freeze
+      ID_TOKEN = "urn:ietf:params:oauth:token-type:id_token".freeze
+      TYPES = [ ACCESS_TOKEN, ID_TOKEN ].freeze
+
+      attr_reader :type, :claims
+
+      def self.read(token, type:, issuer:)
+        held = new(token, type: type, issuer: issuer)
+
+        held.claims ? held : nil
+      end
+
+      def initialize(token, type:, issuer:)
+        @token = token.to_s
+        @type = type.to_s
+        @issuer = issuer
+        @claims = decode
+      end
+
+      def access_token?
+        type == ACCESS_TOKEN
+      end
+
+      def id_token?
+        type == ID_TOKEN
+      end
+
+      def record
+        return @record if defined?(@record)
+
+        @record = access_token? ? AccessToken.live.find_by(digest: claims["jti"]) : nil
+      end
+
+      def live?
+        access_token? ? record.present? : session_live?
+      end
+
+      def actor
+        return @actor if defined?(@actor)
+
+        @actor = access_token? ? record&.actor : Subjects.locate(claims["sub"])
+      end
+
+      def subject
+        claims["sub"]
+      end
+
+      def held_by?(client)
+        return record&.client_id == client.id if access_token?
+
+        Array(claims["aud"]).include?(client.client_id) && (claims["azp"].blank? || claims["azp"] == client.client_id) &&
+          actor.present? && issuer.subject_for(actor, client) == subject
+      end
+
+      def scope_list
+        access_token? ? record.scope_list : []
+      end
+
+      def audience
+        access_token? ? record.audience : []
+      end
+
+      def expires_at
+        access_token? ? record.expires_at : Time.zone.at(claims["exp"].to_i)
+      end
+
+      def act
+        claims["act"]
+      end
+
+      def client_id
+        access_token? ? record&.client&.client_id : Array(claims["aud"]).first
+      end
+
+      private
+
+        attr_reader :token, :issuer
+
+        def decode
+          case type
+          when ACCESS_TOKEN then AccessToken.decode(token, issuer: issuer)
+          when ID_TOKEN then id_token_claims
+          end
+        rescue JWT::DecodeError
+          nil
+        end
+
+        def id_token_claims
+          claims = issuer.verify(token, typ: "jwt", required: %w[iss sub aud exp])
+
+          raise JWT::DecodeError, "that token is not an id token" if claims.key?("jti") || claims.key?("events")
+
+          claims
+        end
+
+        def session_live?
+          return actor.present? if claims["sid"].blank?
+
+          Session.live.exists?(uuid: claims["sid"], actor_id: actor&.id)
+        end
+    end
+  end
+end