masks-server 0.7.0

data/app/controllers/masks/server/handshakes_controller.rb

@@ -0,0 +1,178 @@
+module Masks
+  module Server
+    class HandshakesController < ApplicationController
+      WAIT = 5.seconds
+
+      before_action :require_handshake
+      before_action :require_actor
+      before_action :require_pairing
+      before_action :require_unclaimed_namespaces
+      before_action :require_wait, only: :create
+
+      def show
+        return repair if repeat?
+
+        @scopes = ResourceMetadata.describe(@handshake.resource, @handshake.scopes)
+        @granting = Namespace.prefixes(@handshake.scopes) - current_actor.scope_list
+        @beneath = published_beneath(Namespace.prefixes(@handshake.scopes))
+        @hid = hid_for(@pending)
+        @shown = shown_clock.generate(Time.current.to_f, purpose: @hid, expires_in: PendingHandshake.lifetime)
+      end
+
+      def create
+        claimed = PendingHandshake.claim(hid_for(@pending))
+
+        return refuse(t("handshakes.answered")) if claimed.nil?
+        return redirect_to(@handshake.declined, allow_other_host: true) if params[:approve].blank?
+
+        client = Client.approve!(@handshake, actor: current_actor)
+
+        Event.record!(
+          Event::CLIENT_APPROVED,
+          actor: current_actor, client: client,
+          name: client.name, resource: @handshake.resource
+        )
+
+        Consent.record!(
+          actor: current_actor, client: client,
+          scopes: @handshake.scopes, audience: [ @handshake.resource ]
+        )
+
+        Event.record!(
+          Event::CONSENT_GRANTED,
+          actor: current_actor, client: client,
+          scopes: @handshake.scopes, audience: [ @handshake.resource ]
+        )
+
+        begin
+          Namespace.claim!(@handshake, client: client, actor: current_actor)
+        rescue Namespace::Taken => taken
+          return refuse(taken.message)
+        end
+
+        hand_back(client, claimed)
+      end
+
+      private
+
+        def joining_manage?
+          @existing.present? && @existing.public? && @existing.approved_as?(@handshake) &&
+            @handshake.resource == issuer.manage_resource && current_actor.manages?
+        end
+
+        def repeat?
+          @existing.present? && @existing.public? && @existing.approved_as?(@handshake) &&
+            (Namespace.prefixes(@handshake.scopes) - current_actor.scope_list).empty? &&
+            Consent.covers?(
+              actor: current_actor, client: @existing,
+              scopes: @handshake.scopes, audience: [ @handshake.resource ]
+            )
+        end
+
+        def repair(keeping: false)
+          claimed = PendingHandshake.claim(hid_for(@pending))
+
+          return refuse(t("handshakes.answered")) if claimed.nil?
+
+          hand_back(@existing, claimed, keeping: keeping)
+        end
+
+        def hand_back(client, claimed, keeping: false)
+          token = InitialAccessToken.mint!(
+            actor: current_actor,
+            client: client,
+            parent: claimed,
+            scopes: Scopes.join(@handshake.scopes),
+            audience: [ @handshake.resource ],
+            redirect_uri: @handshake.return_to,
+            payload: ({ "keeping" => true } if keeping)
+          )
+
+          redirect_to @handshake.approved(token.secret, issuer: issuer.url), allow_other_host: true
+        end
+
+        def require_handshake
+          @pending = opening || pending_handshake(params[:hid])
+
+          return if performed?
+          return refuse(t("handshakes.none_in_progress")) if @pending.nil?
+          return refuse(t("handshakes.answered")) if @pending.consumed?
+
+          @handshake = @pending.handshake
+          @existing = Client.approved_for(@handshake.resource)
+        end
+
+        def opening
+          return nil unless request.get? && params[:resource].present?
+
+          handshake = Handshake.from_request(request)
+          return refuse(handshake.refusal) unless handshake.usable?
+
+          track_handshake!(handshake)
+        end
+
+        def require_wait
+          return if params[:approve].blank? || waited?
+
+          flash[:alert] = t("handshakes.too_soon")
+          redirect_to handshake_path(hid: params[:hid])
+        end
+
+        def waited?
+          shown = shown_clock.verified(params[:shown].to_s, purpose: params[:hid].to_s)
+
+          shown.is_a?(Numeric) && Time.current.to_f - shown >= WAIT
+        end
+
+        def shown_clock
+          Server.message_verifier("handshakes/shown")
+        end
+
+        def require_actor
+          redirect_to login_path if current_actor.nil?
+        end
+
+        def require_pairing
+          return if current_actor.owns?
+          return repair(keeping: true) if joining_manage?
+
+          unless current_actor.holds?(Scopes::HANDSHAKE)
+            return refuse(t("handshakes.not_permitted"))
+          end
+
+          if @existing && @existing.approved_by_id != current_actor.id
+            return refuse(t("handshakes.already_connected", resource: @handshake.resource))
+          end
+
+          withheld = current_actor.withheld(@handshake.scopes)
+          return if withheld.empty?
+
+          refuse(t("handshakes.beyond_account", scopes: Scopes.join(withheld)))
+        end
+
+        def published_beneath(prefixes)
+          return {} if prefixes.empty?
+
+          ResourceMetadata.new(@handshake.resource).descriptions.select do |scope, _|
+            prefixes.any? { |prefix| scope.start_with?(prefix) && scope.length > prefix.length }
+          end
+        end
+
+        def require_unclaimed_namespaces
+          refusal = Namespace.refusal(@handshake)
+          return if refusal.nil?
+
+          @manage = manage_path
+
+          refuse(refusal)
+        end
+
+        def refuse(description)
+          @description = description
+
+          render :refused, status: :bad_request
+          nil
+        end
+    end
+  end
+end

data/app/controllers/masks/server/introspections_controller.rb

@@ -0,0 +1,51 @@
+module Masks
+  module Server
+    class IntrospectionsController < ApplicationController
+      include TokenPresented
+
+      INACTIVE = { "active" => false }.freeze
+
+      rate_limit to: 120, within: 1.minute,
+                 by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
+                 with: -> { render json: INACTIVE, status: :too_many_requests }
+
+      def create
+        client = authenticate_client!
+        token = presented_token
+
+        return render json: INACTIVE unless token&.live? && entitled?(client, token)
+
+        render json: described(token)
+      end
+
+      private
+
+        def entitled?(client, token)
+          return true if token.client_id == client.id
+          return false unless client.approved?
+
+          (Array(token.audience) & Array(client.resources)).any?
+        end
+
+        def described(token)
+          {
+            "active" => true,
+            "scope" => Scopes.join(token.scopes),
+            "authorization_details" => token.authorization_details.presence,
+            "client_id" => token.client&.client_id,
+            "username" => token.actor&.identifier,
+            "token_type" => (token.token_type if token.is_a?(AccessToken)),
+            "cnf" => token.confirmation,
+            "exp" => token.expires_at.to_i,
+            "iat" => token.created_at.to_i,
+            "sub" => token.subject(issuer),
+            "aud" => token.audience.presence,
+            "iss" => issuer.url,
+            "jti" => token.digest,
+            Organization::CLAIM => token.organization_claim,
+            "tenant" => current_tenant.to_identity
+          }.compact
+        end
+    end
+  end
+end

data/app/controllers/masks/server/links_controller.rb

@@ -0,0 +1,41 @@
+module Masks
+  module Server
+    class LinksController < ApplicationController
+      def invitation
+        hand_over(Invitation, LoginStates::Invitation::HELD, "invitation")
+      end
+
+      def reset
+        hand_over(PasswordReset, LoginStates::PasswordReset::HELD, "reset")
+      end
+
+      def verify
+        @actor = EmailVerification.settle!(params[:token])
+
+        if @actor.nil?
+          @kind = "confirmation"
+          return render :expired, status: :gone
+        end
+
+        Event.record!(Event::EMAIL_VERIFIED, actor: @actor, email: @actor.email)
+
+        render :verified
+      end
+
+      private
+
+        def hand_over(token, slot, kind)
+          if token.redeem(params[:token]).nil?
+            @kind = kind
+            return render :expired, status: :gone
+          end
+
+          sign_out if current_actor
+
+          replace_login(slot => params[:token])
+
+          redirect_to login_path
+        end
+    end
+  end
+end

data/app/controllers/masks/server/logins_controller.rb

@@ -0,0 +1,239 @@
+module Masks
+  module Server
+    class LoginsController < ApplicationController
+      POSTED = %w[code state error error_description user SAMLResponse RelayState].freeze
+      POSTED_LIMIT = 256.kilobytes
+      POSTED_WINDOW = 5.minutes
+      UNNAVIGABLE = %w[javascript data vbscript file blob].freeze
+
+      skip_forgery_protection
+
+      rate_limit to: ::Rails.configuration.masks.attempt_limit,
+                 within: 3.minutes, only: :update, if: -> { verifying? },
+                 by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
+                 with: -> { too_many("too-many-attempts") }
+
+      rate_limit to: ::Rails.configuration.masks.account_attempt_limit,
+                 within: 3.minutes, only: :update, name: "identifier", if: -> { verifying? },
+                 by: -> { [ current_tenant.id, attempted_account ].join(":") },
+                 with: -> { too_many("too-many-attempts-for-account") }
+
+      rate_limit to: ::Rails.configuration.masks.recovery_limit,
+                 within: 15.minutes, only: :update, name: "recovery",
+                 if: -> { Login.limit_for(params[:event]) == :sending },
+                 by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
+                 with: -> { too_many("too-many-attempts") }
+
+      rate_limit to: ::Rails.configuration.masks.attempt_limit,
+                 within: 3.minutes, only: %i[provider posted_provider], name: "provider",
+                 by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
+                 with: -> { too_many("too-many-attempts") }
+
+      before_action :refuse_blocked_agent
+      before_action :verify_authenticity_token, except: :posted_provider
+      before_action :establish_device, only: %i[update provider]
+
+      def show
+        hold_return_to
+        return redirect_to after_login_path if current_actor && pending.nil?
+
+        @login = run
+        @login.carry!(flash[:warnings]) if flash[:warnings].present?
+
+        redirect_to after_login_path if @login.settled?
+      end
+
+      def update
+        login = run(event: params[:event], updates: update_params)
+
+        settle(login) if login.settled? && pending.nil?
+
+        respond_to do |format|
+          format.html { resume(login) }
+          format.json { render json: serialize(login) }
+        end
+      end
+
+      def provider
+        return link_connection if Linking.pending?(session, callback_params)
+
+        event = LoginStates::Delegation.pending?(login_store, callback_params) ? "delegation:callback" : "provider:callback"
+        login = run(event: event, updates: callback_params)
+
+        settle(login) if login.settled? && pending.nil?
+
+        resume(login)
+      end
+
+      def posted_provider
+        handle = SecureRandom.urlsafe_base64(24)
+
+        ::Rails.cache.write(posted_key(handle), posted_params, expires_in: POSTED_WINDOW)
+
+        redirect_to login_provider_callback_path(params[:key], posted: handle), status: :see_other
+      end
+
+      def destroy
+        login = run
+        login.start_over!
+        sign_out
+
+        respond_to do |format|
+          format.html { resume(login) }
+          format.json { render json: serialize(run) }
+        end
+      end
+
+      private
+
+        def pending
+          return @pending if defined?(@pending)
+
+          @pending = pending_request(resolved_rid)
+        end
+
+        def resolved_rid
+          @resolved_rid ||= params[:rid].presence ||
+            login_store.dig(LoginStates::Provider::HELD, "rid").presence ||
+            login_store.dig(LoginStates::Delegation::HELD, "rid").presence
+        end
+
+        def callback_params
+          @callback_params ||= (params[:posted].present? ? take_posted(params[:posted]) : posted_params)
+            .merge("provider" => params[:key].to_s)
+        end
+
+        def posted_params
+          params.permit(*POSTED).to_h.transform_values { |value| value.to_s[0, POSTED_LIMIT] }
+        end
+
+        def take_posted(handle)
+          key = posted_key(handle)
+          held = ::Rails.cache.read(key)
+          ::Rails.cache.delete(key)
+
+          held.is_a?(Hash) ? held.slice(*POSTED) : {}
+        end
+
+        def posted_key(handle)
+          "provider-callback:#{current_tenant.id}:#{Digest::SHA256.hexdigest(handle.to_s)}"
+        end
+
+        def link_connection
+          provider = Provider.signing_in.find_by(key: params[:key].to_s)
+
+          connection = Linking.finish!(
+            session: session, provider: provider, actor: current_actor, params: callback_params
+          )
+
+          redirect_to root_path(anchor: "connections"), notice: t("connections.linked", provider: connection.provider.name)
+        rescue Linking::Refused => e
+          redirect_to root_path(anchor: "connections"), alert: e.message
+        end
+
+        def run(event: nil, updates: {})
+          Login.new(
+            store: login_store,
+            request: pending,
+            session: current_session,
+            device: current_device,
+            rid: resolved_rid,
+            event: event,
+            updates: updates
+          ).update
+        end
+
+        def update_params
+          params.permit(*Login.permitted_updates).to_h
+        end
+
+        def settle(login)
+          return unless login.actor
+
+          if login.touched?(:first_factor)
+            sign_in(login.actor, amr: login.amr, policy: login.policy, first_factor: login.first_factored_by)
+          elsif login.signed_in? && login.touched?(:second_factor)
+            current_session.update!(amr: Array(current_session.amr) | login.amr)
+          end
+
+          forget_login
+        end
+
+        def serialize(login)
+          login.as_json.merge("redirectTo" => navigable(next_location(login)))
+        end
+
+        def attempted_account
+          identifier = login_store["identifier"].to_s.strip.downcase
+
+          login_store["actor_id"].presence || Actor.locate(identifier)&.id || identifier
+        end
+
+        def navigable(location)
+          scheme = location.to_s.gsub(/[\x00-\x20]/, "")[/\A([a-z][a-z0-9+.-]*):/i, 1]
+
+          location unless scheme && UNNAVIGABLE.include?(scheme.downcase)
+        end
+
+        def verifying?
+          Login.limit_for(params[:event]) == :verifying
+        end
+
+        def resume(login)
+          flash[:warnings] = login.carried if login.warnings.any?
+
+          redirect_to next_location(login) || login_path, allow_other_host: true
+        end
+
+        def next_location(login)
+          return login.redirect_to if login.redirect_to.present?
+          return refuse_device(pending) if login.refused? && pending&.device?
+          return refuse_saml(pending) if login.refused? && pending&.saml?
+          return saml_resume_path(rid: rid_for(pending)) if pending&.saml?
+          return deny(pending, login.refusal.error, login.refusal.description) if login.refused? && pending
+          return device_url_for(pending) if pending&.device?
+          return authorize_url_for(pending) if pending
+          return after_login_path if login.settled?
+
+          nil
+        end
+
+        def too_many(warning)
+          login = run
+          login.warn!(warning)
+
+          respond_to do |format|
+            format.html { resume(login) }
+            format.json { render json: serialize(login), status: :too_many_requests }
+          end
+        end
+
+        def after_login_path
+          pending = latest_handshake
+          return handshake_url_for(pending) if pending
+
+          session.delete(RETURN_TO) || root_path
+        end
+
+        def hold_return_to
+          held = local_path(params[:return_to])
+
+          session[RETURN_TO] = held if held
+        end
+
+        def local_path(value)
+          held = value.to_s
+
+          return nil if !held.start_with?("/") || held.start_with?("//") || held.match?(/[\x00-\x20\x7f\\]/)
+
+          uri = URI.parse(held)
+
+          return nil if uri.scheme || uri.host || uri.userinfo
+
+          "#{uri.path}#{"?#{uri.query}" if uri.query}#{"##{uri.fragment}" if uri.fragment}"
+        rescue URI::InvalidURIError
+          nil
+        end
+    end
+  end
+end

data/app/controllers/masks/server/manage/exports_controller.rb

@@ -0,0 +1,22 @@
+module Masks
+  module Server
+    module Manage
+      class ExportsController < ApplicationController
+        def show
+          export = EventExport.open(params[:token], tenant: current_tenant)
+
+          return head(:not_found) if export.nil?
+          exporter = export.exporter
+
+          return head(:forbidden) unless exporter&.manages? && current_actor&.id == exporter.id
+
+          response.headers["Cache-Control"] = "no-store"
+          response.headers["X-Content-Type-Options"] = "nosniff"
+
+          send_data export.lines(current_tenant).join, type: "application/x-ndjson",
+                                                       filename: export.filename(current_tenant), disposition: "attachment"
+        end
+      end
+    end
+  end
+end

data/app/controllers/masks/server/manage/graphql_controller.rb

@@ -0,0 +1,70 @@
+module Masks
+  module Server
+    module Manage
+      class GraphqlController < ApplicationController
+        include ManageEndpoint
+
+        def execute
+          with_manage_token do |token, actor, roles|
+            render json: ManageSchema.execute(
+              document["query"],
+              variables: document["variables"],
+              operation_name: document["operationName"],
+              context: { actor: actor, client: token.client, token: token, roles: roles, issuer: issuer }
+            )
+          end
+        end
+
+        private
+
+          def document
+            @document ||= uploaded? ? attached : sent
+          end
+
+          def sent
+            {
+              "query" => params[:query],
+              "variables" => parse(params[:variables]),
+              "operationName" => params[:operationName]
+            }
+          end
+
+          def attached
+            operation = parse(params[:operations])
+            variables = parse(operation["variables"])
+
+            parse(params[:map]).each do |part, paths|
+              Array(paths).each { |path| place(variables, path, params[part]) }
+            end
+
+            operation.merge("variables" => variables)
+          end
+
+          def place(variables, path, file)
+            keys = path.to_s.split(".")
+
+            return unless keys.shift == "variables" && keys.any?
+
+            held = keys[0..-2].inject(variables) { |inner, key| inner.is_a?(Hash) ? inner[key] : nil }
+
+            held[keys.last] = file if held.is_a?(Hash)
+          end
+
+          def uploaded?
+            params[:operations].present? && params[:map].present?
+          end
+
+          def parse(value)
+            case value
+            when String then JSON.parse(value.presence || "{}")
+            when ActionController::Parameters then value.to_unsafe_h
+            when Hash then value
+            else {}
+            end
+          rescue JSON::ParserError
+            {}
+          end
+      end
+    end
+  end
+end

data/app/controllers/masks/server/manage_controller.rb

@@ -0,0 +1,19 @@
+module Masks
+  module Server
+    class ManageController < ApplicationController
+      layout "masks/server/manage"
+
+      def index
+        @boot = {
+          issuer: issuer.url,
+          resource: issuer.manage_resource,
+          graphql: manage_graphql_path,
+          root: manage_path,
+          account: root_path,
+          tenant: current_tenant.to_identity,
+          copy: I18n.t("manage", default: {})
+        }
+      end
+    end
+  end
+end

data/app/controllers/masks/server/notifications_controller.rb

@@ -0,0 +1,23 @@
+module Masks
+  module Server
+    class NotificationsController < ApplicationController
+      before_action :require_actor
+
+      def update
+        current_actor.update!(notifications: wanted)
+
+        redirect_to "#{root_path}#notifications", notice: t("notifications.saved")
+      end
+
+      private
+
+        def wanted
+          Array(params[:notifications]).map(&:to_s) & Notifications::MAILED
+        end
+
+        def require_actor
+          redirect_to login_path unless current_actor
+        end
+    end
+  end
+end