masks-server 0.7.0

data/app/models/masks/server/saml_identity/response.rb

@@ -0,0 +1,137 @@
+module Masks
+  module Server
+    module SamlIdentity
+      class Response
+        attr_reader :issuer, :client, :destination, :in_response_to, :name_id
+
+        def initialize(issuer:, client:, destination:, in_response_to: nil)
+          @issuer = issuer
+          @client = client
+          @destination = destination
+          @in_response_to = in_response_to
+          @now = Time.current.utc
+        end
+
+        def success(actor:, session:, name_id_format:, scopes:, authenticated_at:, amr:)
+          assertion = sign(assertion_xml(actor, session, name_id_format, scopes, authenticated_at, amr))
+
+          encode(sign(response_xml(SUCCESS) { |xml| xml << assertion }))
+        end
+
+        def failure(status, second = nil, message = nil)
+          encode(sign(response_xml(status, second, message)))
+        end
+
+        def logout(status = SUCCESS, second = nil, message = nil)
+          encode(sign(response_xml(status, second, message, element: "LogoutResponse")))
+        end
+
+        private
+
+          attr_reader :now
+
+          def entity
+            SamlIdentity.entity_id(issuer)
+          end
+
+          def response_xml(status, second = nil, message = nil, element: "Response")
+            Nokogiri::XML::Builder.new(encoding: "UTF-8") do |xml|
+              xml["samlp"].public_send(element,
+                { "xmlns:samlp" => PROTOCOL_NS, "xmlns:saml" => ASSERTION_NS, "ID" => identifier, "Version" => "2.0",
+                  "IssueInstant" => instant(now), "Destination" => destination, "InResponseTo" => in_response_to }.compact
+              ) do
+                xml["saml"].Issuer(entity)
+                xml["samlp"].Status do
+                  xml["samlp"].StatusCode(Value: status) do
+                    xml["samlp"].StatusCode(Value: second) if second
+                  end
+                  xml["samlp"].StatusMessage(message) if message
+                end
+                yield xml if block_given?
+              end
+            end.doc.root.to_xml(save_with: Nokogiri::XML::Node::SaveOptions::AS_XML)
+          end
+
+          def assertion_xml(actor, session, name_id_format, scopes, authenticated_at, amr)
+            claims = actor.claims(scopes, origin: issuer.url, subject: issuer.subject_for(actor, client))
+            expires = now + LIFETIME
+            @name_id = name_for(actor, name_id_format)
+
+            Nokogiri::XML::Builder.new(encoding: "UTF-8") do |xml|
+              xml["saml"].Assertion("xmlns:saml" => ASSERTION_NS, "ID" => identifier, "Version" => "2.0",
+                                    "IssueInstant" => instant(now)) do
+                xml["saml"].Issuer(entity)
+                xml["saml"].Subject do
+                  xml["saml"].NameID(name_id, Format: name_id_format)
+                  xml["saml"].SubjectConfirmation(Method: "urn:oasis:names:tc:SAML:2.0:cm:bearer") do
+                    xml["saml"].SubjectConfirmationData(
+                      { "NotOnOrAfter" => instant(expires), "Recipient" => destination, "InResponseTo" => in_response_to }.compact
+                    )
+                  end
+                end
+                xml["saml"].Conditions(NotBefore: instant(now - 1.minute), NotOnOrAfter: instant(expires)) do
+                  xml["saml"].AudienceRestriction { xml["saml"].Audience(client.saml_entity_id) }
+                end
+                xml["saml"].AuthnStatement({ "AuthnInstant" => instant(authenticated_at || now),
+                                             "SessionIndex" => session && SamlIdentity.session_index(session) }.compact) do
+                  xml["saml"].AuthnContext do
+                    xml["saml"].AuthnContextClassRef(Array(amr).include?(Issuer::MULTI_FACTOR) ? MFA_CONTEXT : PASSWORD_CONTEXT)
+                  end
+                end
+
+                released = attributes(claims)
+
+                if released.any?
+                  xml["saml"].AttributeStatement do
+                    released.each do |name, value|
+                      xml["saml"].Attribute(Name: name, NameFormat: "urn:oasis:names:tc:SAML:2.0:attrname-format:basic") do
+                        Array(value).each { |one| xml["saml"].AttributeValue(one.to_s) }
+                      end
+                    end
+                  end
+                end
+              end
+            end.doc.root.to_xml(save_with: Nokogiri::XML::Node::SaveOptions::AS_XML)
+          end
+
+          def name_for(actor, format)
+            case format
+            when EMAIL
+              raise Refused, "#{actor.identifier} has no confirmed email to be named by" unless actor.email.present? && actor.email_verified_at
+
+              actor.email
+            else
+              issuer.subject_for(actor, client)
+            end
+          end
+
+          def attributes(claims)
+            mapping = client.saml_attributes.presence || DEFAULT_ATTRIBUTES
+
+            confirmed = claims.except(*("email" unless claims["email_verified"]))
+
+            mapping.filter_map do |name, claim|
+              value = confirmed[claim.to_s]
+              [ name.to_s, value ] unless value.nil? || value == ""
+            end
+          end
+
+          def sign(xml)
+            SamlIdentity.sign(issuer, xml)
+          end
+
+          def encode(xml)
+            Base64.strict_encode64(xml)
+          end
+
+          def identifier
+            SamlIdentity.identifier
+          end
+
+          def instant(time)
+            SamlIdentity.instant(time)
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/saml_identity/sign_off.rb

@@ -0,0 +1,46 @@
+module Masks
+  module Server
+    module SamlIdentity
+      class SignOff
+        attr_reader :id, :client
+
+        def initialize(issuer:, client:, name_id:, name_id_format:, session_index:)
+          @issuer = issuer
+          @client = client
+          @name_id = name_id
+          @name_id_format = name_id_format
+          @session_index = session_index
+          @id = SamlIdentity.identifier
+        end
+
+        def destination
+          client.saml_slo_url
+        end
+
+        def encoded
+          @encoded ||= Base64.strict_encode64(SamlIdentity.sign(issuer, to_xml))
+        end
+
+        private
+
+          attr_reader :issuer, :name_id, :name_id_format, :session_index
+
+          def to_xml
+            now = Time.current
+
+            Nokogiri::XML::Builder.new(encoding: "UTF-8") do |xml|
+              xml["samlp"].LogoutRequest(
+                "xmlns:samlp" => PROTOCOL_NS, "xmlns:saml" => ASSERTION_NS, "ID" => id, "Version" => "2.0",
+                "IssueInstant" => SamlIdentity.instant(now), "NotOnOrAfter" => SamlIdentity.instant(now + LIFETIME),
+                "Destination" => destination, "Reason" => "urn:oasis:names:tc:SAML:2.0:logout:user"
+              ) do
+                xml["saml"].Issuer(SamlIdentity.entity_id(issuer))
+                xml["saml"].NameID(name_id, Format: name_id_format)
+                xml["samlp"].SessionIndex(session_index)
+              end
+            end.doc.root.to_xml(save_with: Nokogiri::XML::Node::SaveOptions::AS_XML)
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/saml_identity.rb

@@ -0,0 +1,87 @@
+module Masks
+  module Server
+    module SamlIdentity
+      PROTOCOL = "saml".freeze
+      PROTOCOL_NS = "urn:oasis:names:tc:SAML:2.0:protocol".freeze
+      ASSERTION_NS = "urn:oasis:names:tc:SAML:2.0:assertion".freeze
+      METADATA_NS = "urn:oasis:names:tc:SAML:2.0:metadata".freeze
+      DSIG_NS = "http://www.w3.org/2000/09/xmldsig#".freeze
+      POST_BINDING = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST".freeze
+      REDIRECT_BINDING = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect".freeze
+
+      PERSISTENT = "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent".freeze
+      EMAIL = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress".freeze
+      UNSPECIFIED = "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified".freeze
+      NAME_ID_FORMATS = [ PERSISTENT, EMAIL, UNSPECIFIED ].freeze
+
+      SUCCESS = "urn:oasis:names:tc:SAML:2.0:status:Success".freeze
+      RESPONDER = "urn:oasis:names:tc:SAML:2.0:status:Responder".freeze
+      REQUEST_DENIED = "urn:oasis:names:tc:SAML:2.0:status:RequestDenied".freeze
+      NO_PASSIVE = "urn:oasis:names:tc:SAML:2.0:status:NoPassive".freeze
+      REQUESTER = "urn:oasis:names:tc:SAML:2.0:status:Requester".freeze
+      UNKNOWN_PRINCIPAL = "urn:oasis:names:tc:SAML:2.0:status:UnknownPrincipal".freeze
+
+      PASSWORD_CONTEXT = "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport".freeze
+      MFA_CONTEXT = "https://refeds.org/profile/mfa".freeze
+
+      SCOPES = [ Scopes::OPENID, Scopes::PROFILE, Scopes::EMAIL ].freeze
+      DEFAULT_ATTRIBUTES = {
+        "email" => "email",
+        "name" => "name",
+        "given_name" => "given_name",
+        "family_name" => "family_name",
+        "preferred_username" => "preferred_username"
+      }.freeze
+
+      LIFETIME = 5.minutes
+      CLOCK_SKEW = 3.minutes
+      LIMIT = 64.kilobytes
+
+      class Refused < StandardError; end
+
+      def self.parse!(xml, what:)
+        raise Refused, "#{what} is too large" if xml.bytesize > LIMIT
+        raise Refused, "#{what} may not declare a document type" if xml.match?(/<!DOCTYPE/i)
+
+        Nokogiri::XML(xml) { |config| config.strict.nonet }
+      rescue Nokogiri::XML::SyntaxError
+        raise Refused, "#{what} is not well-formed XML"
+      end
+
+      def self.sso_url(issuer)
+        "#{issuer.url}/saml/sso"
+      end
+
+      def self.slo_url(issuer)
+        "#{issuer.url}/saml/slo"
+      end
+
+      def self.metadata_url(issuer)
+        "#{issuer.url}/saml/metadata"
+      end
+
+      def self.entity_id(issuer)
+        metadata_url(issuer)
+      end
+
+      def self.session_index(session)
+        "_#{session.uuid}"
+      end
+
+      def self.sign(issuer, xml)
+        key = issuer.key
+        document = XMLSecurity::Document.new(xml)
+        document.sign_document(key.private_key, key.certificate, XMLSecurity::Document::RSA_SHA256, XMLSecurity::Document::SHA256)
+        document.to_s
+      end
+
+      def self.identifier
+        "_#{SecureRandom.hex(20)}"
+      end
+
+      def self.instant(time)
+        time.utc.iso8601
+      end
+    end
+  end
+end

data/app/models/masks/server/saml_participation.rb

@@ -0,0 +1,35 @@
+module Masks
+  module Server
+    class SamlParticipation < ApplicationRecord
+      include TenantScoped
+
+      belongs_to :session
+      belongs_to :client
+
+      scope :unnotified, -> { where(notified_at: nil) }
+      scope :listening, -> { joins(:client).merge(Client.speaking(SamlIdentity::PROTOCOL)).where.not(clients: { saml_slo_url: [ nil, "" ] }) }
+
+      class << self
+        def record!(session:, client:, name_id:, name_id_format:)
+          participation = find_or_initialize_by(session: session, client: client)
+          participation.update!(name_id: name_id, name_id_format: name_id_format,
+                                session_index: SamlIdentity.session_index(session), notified_at: nil)
+          participation
+        end
+
+        def claim!(scope)
+          scope.unnotified.listening.includes(:client).order(:id).select(&:claimed?)
+        end
+      end
+
+      def claimed?
+        self.class.where(id: id, notified_at: nil).update_all(notified_at: Time.current) == 1
+      end
+
+      def sign_off(issuer)
+        SamlIdentity::SignOff.new(issuer: issuer, client: client, name_id: name_id, name_id_format: name_id_format,
+                                  session_index: session_index)
+      end
+    end
+  end
+end

data/app/models/masks/server/scim/directory.rb

@@ -0,0 +1,57 @@
+module Masks
+  module Server
+    module Scim
+      class Directory
+        ID = "directory_id".freeze
+
+        def self.for(organization)
+          organization ? OrganizationDirectory.new(organization) : new
+        end
+
+        def organization
+          nil
+        end
+
+        def people
+          Actor.select("actors.*", "actors.external_id AS #{ID}")
+        end
+
+        def columns
+          {}
+        end
+
+        def user(actor)
+          User.new(actor, external_id: actor.has_attribute?(ID) ? actor[ID] : nil)
+        end
+
+        def save!(actor, external_id)
+          actor.external_id = external_id
+          actor.save!
+        end
+
+        def owned(actor_ids)
+          actor_ids.to_set
+        end
+
+        def owned!(actor); end
+
+        def proven!(actor); end
+
+        def remove!(actor)
+          keep_a_manager!(actor)
+
+          held = { uuid: actor.uuid, identifier: actor.identifier, via: "scim" }
+
+          actor.destroy!
+          Event.record!(Event::ACTOR_DELETED, by: nil, **held)
+        end
+
+        def keep_a_manager!(actor)
+          return unless actor.last_manager?
+
+          raise Error.new(:conflict, "#{actor.identifier} is the last person who manages masks here", scim_type: "mutability")
+        end
+      end
+    end
+  end
+end

data/app/models/masks/server/scim/filter.rb

@@ -0,0 +1,124 @@
+module Masks
+  module Server
+    module Scim
+      class Filter
+        COMPARISON = /\A\s*([A-Za-z][\w.:\[\]" -]*?)\s+(eq|ne|co|sw|ew|pr|gt|ge|lt|le)(?:\s+("(?:[^"\\]|\\.)*"|true|false|null|[\d.]+))?\s*\z/i
+        ATTRIBUTES = {
+          "id" => "actors.uuid",
+          "username" => :user_name,
+          "externalid" => "actors.external_id",
+          "emails" => "actors.email",
+          "emails.value" => "actors.email",
+          "displayname" => "actors.name",
+          "name.givenname" => "actors.given_name",
+          "name.familyname" => "actors.family_name",
+          "active" => :active,
+          "meta.created" => "actors.created_at",
+          "meta.lastmodified" => "actors.updated_at"
+        }.freeze
+        CASE_EXACT = %w[externalid].freeze
+
+        def self.apply(relation, expression, columns: {})
+          return relation if expression.blank?
+
+          new(expression, columns: columns).apply(relation)
+        end
+
+        def initialize(expression, columns: {})
+          @expression = expression.to_s
+          @columns = ATTRIBUTES.merge(columns)
+        end
+
+        def apply(relation)
+          clauses = @expression.split(/\s+and\s+/i)
+
+          raise Error.new(:bad_request, "at most four comparisons joined by and are understood", scim_type: "invalidFilter") if clauses.size > 4
+
+          clauses.reduce(relation) { |held, clause| compare(held, clause) }
+        end
+
+        private
+
+          def compare(relation, clause)
+            match = COMPARISON.match(clause)
+
+            raise Error.new(:bad_request, "#{clause.strip} is not a filter this server reads", scim_type: "invalidFilter") if match.nil?
+
+            path, operator, raw = match.captures
+            key = normalized(path)
+            column = @columns[key]
+            operator = operator.downcase
+
+            raise Error.new(:bad_request, "#{path} cannot be filtered on", scim_type: "invalidFilter") if column.nil?
+
+            value = literal(raw)
+
+            case column
+            when :user_name then user_name(relation, operator, value)
+            when :active then active(relation, operator, value)
+            else column_compare(relation, column, operator, value, exact: CASE_EXACT.include?(key))
+            end
+          end
+
+          def normalized(path)
+            path.to_s.downcase.sub(/\Aurn:ietf:params:scim:schemas:core:2\.0:user:/, "").sub(/\[type eq "work"\]|\[primary eq true\]/, "")
+          end
+
+          def literal(raw)
+            return nil if raw.nil? || raw == "null"
+            return raw == "true" if %w[true false].include?(raw)
+            return JSON.parse(raw) if raw.start_with?('"')
+
+            raw
+          rescue JSON::ParserError
+            raise Error.new(:bad_request, "#{raw} is not a value this server reads", scim_type: "invalidFilter")
+          end
+
+          def user_name(relation, operator, value)
+            raise Error.new(:bad_request, "userName is filtered with eq", scim_type: "invalidFilter") unless operator == "eq"
+
+            wanted = value.to_s.strip
+            relation.where("lower(actors.nickname) = :wanted OR lower(actors.email) = :wanted", wanted: wanted.downcase)
+          end
+
+          def active(relation, operator, value)
+            raise Error.new(:bad_request, "active is filtered with eq", scim_type: "invalidFilter") unless operator == "eq"
+
+            value ? relation.where(suspended_at: nil) : relation.where.not(suspended_at: nil)
+          end
+
+          def column_compare(relation, column, operator, value, exact:)
+            node = attribute(column)
+            text = value.to_s
+            held = exact ? node : lowered(node)
+            wanted = exact ? text : text.downcase
+            like = ActiveRecord::Base.sanitize_sql_like(wanted)
+
+            relation.where(
+              case operator
+              when "eq" then held.eq(wanted)
+              when "ne" then node.eq(nil).or(held.not_eq(wanted))
+              when "co" then held.matches("%#{like}%", nil, true)
+              when "sw" then held.matches("#{like}%", nil, true)
+              when "ew" then held.matches("%#{like}", nil, true)
+              when "pr" then node.not_eq(nil)
+              when "gt" then node.gt(text)
+              when "ge" then node.gteq(text)
+              when "lt" then node.lt(text)
+              when "le" then node.lteq(text)
+              end
+            )
+          end
+
+          def attribute(column)
+            table, name = column.split(".")
+            Arel::Table.new(table)[name]
+          end
+
+          def lowered(node)
+            Arel::Nodes::NamedFunction.new("lower", [ Arel::Nodes::NamedFunction.new("CAST", [ node.as("text") ]) ])
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/scim/group.rb

@@ -0,0 +1,142 @@
+module Masks
+  module Server
+    module Scim
+      class Group
+        MEMBER_PATH = /\Amembers(?:\[\s*value\s+eq\s+"([^"]+)"\s*\])?(?:\.value)?\z/i
+        FILTER = /\A\s*(displayName|id)\s+eq\s+"((?:[^"\\]|\\.)*)"\s*\z/i
+
+        attr_reader :organization, :role
+
+        class << self
+          def all(organization, holders: nil)
+            held = holders.includes(:actor).order(:created_at, :id).group_by(&:role) if holders
+
+            organization.role_list.map { |role| new(organization, role, held && held.fetch(role, [])) }
+          end
+
+          def find(organization, id)
+            all(organization).find { |group| group.id == id.to_s }
+          end
+
+          def filter(groups, expression)
+            return groups if expression.blank?
+
+            match = FILTER.match(expression.to_s)
+
+            raise Error.new(:bad_request, "Groups are filtered by displayName or id with eq", scim_type: "invalidFilter") if match.nil?
+
+            attribute, value = match.captures
+            wanted = JSON.parse(%("#{value}"))
+
+            groups.select { |group| attribute.casecmp?("id") ? group.id == wanted : group.role.casecmp?(wanted) }
+          end
+        end
+
+        def initialize(organization, role, holders = nil)
+          @organization = organization
+          @role = role
+          @holders = holders
+        end
+
+        def id
+          "#{organization.uuid}.#{role}"
+        end
+
+        def built_in?
+          Organization::BUILT_IN.include?(role)
+        end
+
+        def memberships
+          organization.memberships.accepted.where(role: role).includes(:actor).order(:created_at, :id)
+        end
+
+        def rename!(value)
+          return if value.to_s == role
+
+          raise Error.new(:bad_request, "a group is a role, and a role's name does not change", scim_type: "mutability")
+        end
+
+        def to_h(base:, members: true)
+          {
+            "schemas" => [ GROUP ],
+            "id" => id,
+            "displayName" => role,
+            "members" => (listed(base) if members),
+            "meta" => {
+              "resourceType" => "Group",
+              "created" => organization.created_at&.iso8601,
+              "lastModified" => organization.updated_at&.iso8601,
+              "location" => "#{base}/Groups/#{id}"
+            }
+          }.compact
+        end
+
+        def changes(operations)
+          raise Error.new(:bad_request, "a PATCH carries Operations", scim_type: "invalidSyntax") unless operations.is_a?(Array)
+
+          operations.each_with_object({ add: [], remove: [], replace: nil }) do |operation, held|
+            op = operation["op"].to_s.downcase
+            path = operation["path"].to_s.strip.presence
+            value = operation["value"]
+
+            raise Error.new(:bad_request, "#{operation['op']} is not an operation", scim_type: "invalidSyntax") unless %w[add replace remove].include?(op)
+
+            if path.nil?
+              unpathed!(op, value, held)
+            elsif (match = MEMBER_PATH.match(path))
+              pathed!(op, match[1], value, held)
+            elsif path.casecmp?("displayName")
+              rename!(value)
+            else
+              raise Error.new(:bad_request, "#{path} is not a Group attribute that changes here", scim_type: "noTarget")
+            end
+          end
+        end
+
+        def member_ids(value)
+          (value.is_a?(Hash) ? [ value ] : Array(value)).map do |member|
+            uuid = member.is_a?(Hash) ? member["value"] : member
+
+            raise Error.new(:bad_request, "each member names a user by value", scim_type: "invalidValue") if uuid.blank?
+
+            uuid.to_s
+          end
+        end
+
+        private
+
+          def listed(base)
+            (@holders || memberships).map do |membership|
+              { "value" => membership.actor.uuid, "display" => membership.actor.identifier,
+                "$ref" => "#{base}/Users/#{membership.actor.uuid}", "type" => "User" }
+            end
+          end
+
+          def unpathed!(op, value, held)
+            raise Error.new(:bad_request, "an operation without a path carries an object", scim_type: "invalidValue") unless value.is_a?(Hash)
+
+            rename!(value["displayName"]) if value.key?("displayName")
+
+            return unless value.key?("members")
+
+            op == "replace" ? held[:replace] = member_ids(value["members"]) : held[op.to_sym].concat(member_ids(value["members"]))
+          end
+
+          def pathed!(op, filtered, value, held)
+            case op
+            when "add" then held[:add].concat(member_ids(value))
+            when "replace" then held[:replace] = member_ids(value)
+            when "remove"
+              if filtered
+                held[:remove] << filtered
+              elsif value.nil?
+                held[:replace] = []
+              else
+                held[:remove].concat(member_ids(value))
+              end
+            end
+          end
+      end
+    end
+  end
+end