masks-server 0.7.0

data/app/models/masks/server/senders/mail.rb

@@ -0,0 +1,36 @@
+module Masks
+  module Server
+    module Senders
+      class Mail < Sender
+        self.kind = MAIL
+
+        field :from, label: "From address", hint: "Every email masks sends comes from here."
+
+        validate :from_is_an_address
+
+        def from
+          self[:from]
+        end
+
+        def delivery_method
+          raise NotImplementedError
+        end
+
+        def deliver_test(to, journey:)
+          raise Failed, "that is not an email address" unless to.to_s.match?(URI::MailTo::EMAIL_REGEXP)
+
+          SenderMailer.trial(to, sender: self, journey: journey).deliver_now
+        rescue Net::SMTPError, IOError, SystemCallError, SocketError, Timeout::Error, OpenSSL::SSL::SSLError => error
+          raise Failed, "the mail server could not take the message: #{error.class}"
+        end
+
+        private
+
+          def from_is_an_address
+            errors.add(:base, "From address must be an email address") if
+              from.present? && !from.match?(URI::MailTo::EMAIL_REGEXP)
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/senders/message_bird.rb

@@ -0,0 +1,20 @@
+module Masks
+  module Server
+    module Senders
+      class MessageBird < Sms
+        self.label = "MessageBird"
+
+        field :access_key, label: "Access key", secret: true
+        field :from, label: "Originator", hint: "A number, or up to 11 letters and digits."
+
+        def deliver(to:, body:)
+          post_json(
+            "https://rest.messagebird.com/messages",
+            { originator: sender, recipients: [ to.delete_prefix("+") ], body: body },
+            "Authorization" => "AccessKey #{self[:access_key]}"
+          )
+        end
+      end
+    end
+  end
+end

data/app/models/masks/server/senders/plivo.rb

@@ -0,0 +1,19 @@
+module Masks
+  module Server
+    module Senders
+      class Plivo < Sms
+        field :auth_id, label: "Auth ID"
+        field :auth_token, label: "Auth token", secret: true
+        field :from, label: "From"
+
+        def deliver(to:, body:)
+          post_json(
+            "https://api.plivo.com/v1/Account/#{ERB::Util.url_encode(self[:auth_id])}/Message/",
+            { src: sender, dst: to, text: body },
+            "Authorization" => basic(self[:auth_id], self[:auth_token])
+          )
+        end
+      end
+    end
+  end
+end

data/app/models/masks/server/senders/sinch.rb

@@ -0,0 +1,22 @@
+module Masks
+  module Server
+    module Senders
+      class Sinch < Sms
+        REGIONS = %w[us eu au br ca].freeze
+
+        field :service_plan_id, label: "Service plan ID"
+        field :api_token, label: "API token", secret: true
+        field :region, label: "Region", options: REGIONS, default: "us"
+        field :from, label: "From"
+
+        def deliver(to:, body:)
+          post_json(
+            "https://#{self[:region]}.sms.api.sinch.com/xms/v1/#{ERB::Util.url_encode(self[:service_plan_id])}/batches",
+            { from: sender, to: [ to ], body: body },
+            "Authorization" => "Bearer #{self[:api_token]}"
+          )
+        end
+      end
+    end
+  end
+end

data/app/models/masks/server/senders/sms.rb

@@ -0,0 +1,76 @@
+module Masks
+  module Server
+    module Senders
+      class Sms < Sender
+        NUMBER = /\A\+[1-9]\d{6,14}\z/
+
+        self.kind = SMS
+
+        def self.number(value)
+          held = Actor.normalize_value_for(:phone, value)
+
+          held&.match?(NUMBER) ? held : nil
+        end
+
+        def deliver(to:, body:)
+          raise NotImplementedError
+        end
+
+        def deliver_test(to, journey:)
+          number = self.class.number(to)
+
+          raise Failed, "that is not a phone number in international form, like +15551234567" if number.nil?
+
+          deliver(to: number, body: I18n.t("senders.test.sms", tenant: journey.heading))
+        end
+
+        private
+
+          def sender
+            self[:from]
+          end
+
+          def post_json(url, payload, headers = {})
+            request(url, payload.to_json, headers.merge("Content-Type" => "application/json"))
+          end
+
+          def post_form(url, form, headers = {})
+            post_encoded(url, URI.encode_www_form(form), headers)
+          end
+
+          def post_encoded(url, body, headers = {})
+            request(url, body, headers.merge("Content-Type" => "application/x-www-form-urlencoded"))
+          end
+
+          def basic(user, password)
+            "Basic #{Base64.strict_encode64("#{user}:#{password}")}"
+          end
+
+          def request(url, body, headers)
+            uri = URI(url)
+            held = Net::HTTP::Post.new(uri, headers.merge("Accept" => "application/json"))
+            held.body = body
+
+            response = Outbound.request!(uri, held)
+
+            refuse!(response) unless response.is_a?(Net::HTTPSuccess)
+
+            response
+          rescue Outbound::Refused, IOError, SystemCallError, Timeout::Error, OpenSSL::SSL::SSLError, SocketError => error
+            raise Failed, "#{self.class.label} could not be reached: #{error.message}"
+          end
+
+          def refuse!(response)
+            raise Failed, "#{self.class.label} refused the message (#{response.code}): " \
+                          "#{Outbound.body(response).byteslice(0, 300)}"
+          end
+
+          def parsed(response)
+            JSON.parse(Outbound.body(response))
+          rescue JSON::ParserError
+            {}
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/senders/sms_log.rb

@@ -0,0 +1,19 @@
+module Masks
+  module Server
+    module Senders
+      class SmsLog < Sms
+        self.label = "Log only (development)"
+
+        def self.deliveries
+          @deliveries ||= []
+        end
+
+        def deliver(to:, body:)
+          self.class.deliveries << { to: to, body: body }
+          ::Rails.logger.info("[sms] to #{to}: #{body}")
+          true
+        end
+      end
+    end
+  end
+end

data/app/models/masks/server/senders/smtp.rb

@@ -0,0 +1,60 @@
+module Masks
+  module Server
+    module Senders
+      class Smtp < Mail
+        AUTHENTICATIONS = %w[plain login cram_md5].freeze
+        TIMEOUT = 10
+        UNREACHABLE = "Server resolves to an address this server will not call".freeze
+
+        self.label = "SMTP"
+
+        field :address, label: "Server", hint: "smtp.example.com"
+        field :port, label: "Port", type: :integer, default: 587
+        field :username, label: "Username", required: false
+        field :password, label: "Password", secret: true, required: false
+        field :authentication, label: "Authentication", options: AUTHENTICATIONS, default: "plain"
+        field :domain, label: "HELO domain", required: false
+        field :tls, label: "Implicit TLS", type: :boolean, default: false,
+                    hint: "Off means STARTTLS, which is what port 587 expects."
+
+        validate :port_is_a_port
+        validate :address_is_public
+
+        def delivery_method
+          raise Failed, UNREACHABLE unless public?
+
+          [
+            :smtp,
+            {
+              address: self[:address],
+              port: self[:port],
+              user_name: self[:username],
+              password: self[:password],
+              authentication: self[:authentication].to_sym,
+              domain: self[:domain],
+              tls: self[:tls],
+              enable_starttls: !self[:tls],
+              openssl_verify_mode: OpenSSL::SSL::VERIFY_PEER,
+              open_timeout: TIMEOUT,
+              read_timeout: TIMEOUT
+            }.compact
+          ]
+        end
+
+        private
+
+          def public?
+            ::Rails.env.local? || Outbound.public_address(self[:address], self[:port].to_i).present?
+          end
+
+          def address_is_public
+            errors.add(:base, UNREACHABLE) if self[:address].present? && !public?
+          end
+
+          def port_is_a_port
+            errors.add(:base, "Port must be between 1 and 65535") unless (1..65_535).cover?(self[:port].to_i)
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/senders/sns.rb

@@ -0,0 +1,72 @@
+module Masks
+  module Server
+    module Senders
+      class Sns < Sms
+        SERVICE = "sns".freeze
+        VERSION = "2010-03-31".freeze
+        REGION = /\A[a-z]{2}(-[a-z]+)+-\d\z/
+
+        self.label = "Amazon SNS"
+
+        field :access_key_id, label: "Access key ID"
+        field :secret_access_key, label: "Secret access key", secret: true
+        field :region, label: "Region", default: "us-east-1"
+        field :from, label: "Sender ID", required: false, hint: "Honoured only where the destination allows one."
+
+        validate :region_is_a_region
+
+        def deliver(to:, body:)
+          form = { "Action" => "Publish", "Version" => VERSION, "PhoneNumber" => to, "Message" => body }
+
+          if sender.present?
+            form["MessageAttributes.entry.1.Name"] = "AWS.SNS.SMS.SenderID"
+            form["MessageAttributes.entry.1.Value.DataType"] = "String"
+            form["MessageAttributes.entry.1.Value.StringValue"] = sender
+          end
+
+          payload = URI.encode_www_form(form)
+
+          post_encoded("https://#{host}/", payload, signed(payload))
+        end
+
+        private
+
+          def host
+            "sns.#{self[:region]}.amazonaws.com"
+          end
+
+          def signed(payload, now = Time.now.utc)
+            stamp = now.strftime("%Y%m%dT%H%M%SZ")
+            date = now.strftime("%Y%m%d")
+            scope = "#{date}/#{self[:region]}/#{SERVICE}/aws4_request"
+            content_type = "application/x-www-form-urlencoded"
+            digest = OpenSSL::Digest::SHA256.hexdigest(payload)
+
+            headers = { "content-type" => content_type, "host" => host, "x-amz-date" => stamp }
+            names = headers.keys.sort.join(";")
+            canonical = [
+              "POST", "/", "",
+              headers.sort.map { |name, value| "#{name}:#{value}\n" }.join,
+              names, digest
+            ].join("\n")
+
+            to_sign = [ "AWS4-HMAC-SHA256", stamp, scope, OpenSSL::Digest::SHA256.hexdigest(canonical) ].join("\n")
+
+            key = [ date, self[:region], SERVICE, "aws4_request" ].reduce("AWS4#{self[:secret_access_key]}") do |held, part|
+              OpenSSL::HMAC.digest("SHA256", held, part)
+            end
+
+            {
+              "X-Amz-Date" => stamp,
+              "Authorization" => "AWS4-HMAC-SHA256 Credential=#{self[:access_key_id]}/#{scope}, " \
+                                 "SignedHeaders=#{names}, Signature=#{OpenSSL::HMAC.hexdigest('SHA256', key, to_sign)}"
+            }
+          end
+
+          def region_is_a_region
+            errors.add(:base, "Region must look like us-east-1") if self[:region].present? && !self[:region].match?(REGION)
+          end
+      end
+    end
+  end
+end

data/app/models/masks/server/senders/telnyx.rb

@@ -0,0 +1,18 @@
+module Masks
+  module Server
+    module Senders
+      class Telnyx < Sms
+        field :api_key, label: "API key", secret: true
+        field :from, label: "From", hint: "A Telnyx number, or a messaging profile's alphanumeric sender."
+
+        def deliver(to:, body:)
+          post_json(
+            "https://api.telnyx.com/v2/messages",
+            { from: sender, to: to, text: body },
+            "Authorization" => "Bearer #{self[:api_key]}"
+          )
+        end
+      end
+    end
+  end
+end

data/app/models/masks/server/senders/twilio.rb

@@ -0,0 +1,21 @@
+module Masks
+  module Server
+    module Senders
+      class Twilio < Sms
+        field :account_sid, label: "Account SID"
+        field :auth_token, label: "Auth token", secret: true
+        field :from, label: "From", hint: "A Twilio number like +15551234567, or a Messaging Service SID."
+
+        def deliver(to:, body:)
+          sender_field = sender.to_s.start_with?("MG") ? "MessagingServiceSid" : "From"
+
+          post_form(
+            "https://api.twilio.com/2010-04-01/Accounts/#{ERB::Util.url_encode(self[:account_sid])}/Messages.json",
+            { "To" => to, sender_field => sender, "Body" => body },
+            "Authorization" => basic(self[:account_sid], self[:auth_token])
+          )
+        end
+      end
+    end
+  end
+end

data/app/models/masks/server/senders/vonage.rb

@@ -0,0 +1,25 @@
+module Masks
+  module Server
+    module Senders
+      class Vonage < Sms
+        field :api_key, label: "API key"
+        field :api_secret, label: "API secret", secret: true
+        field :from, label: "From", hint: "A number or an alphanumeric sender ID."
+
+        def deliver(to:, body:)
+          response = post_form(
+            "https://rest.nexmo.com/sms/json",
+            { "api_key" => self[:api_key], "api_secret" => self[:api_secret],
+              "from" => sender.delete_prefix("+"), "to" => to.delete_prefix("+"), "text" => body }
+          )
+
+          held = Array(parsed(response)["messages"]).first || {}
+
+          raise Failed, "Vonage refused the message: #{held['error-text'] || 'no status'}" unless held["status"] == "0"
+
+          response
+        end
+      end
+    end
+  end
+end

data/app/models/masks/server/session.rb

@@ -0,0 +1,134 @@
+module Masks
+  module Server
+    class Session < ApplicationRecord
+      include TenantScoped
+
+      LIFETIME = 14.days
+      FRESHNESS = 15.minutes
+      SEEN_EVERY = 1.minute
+
+      belongs_to :actor
+      belongs_to :device, optional: true
+      has_many :saml_participations
+
+      scope :unexpired, -> { where(revoked_at: nil).where("expires_at > ?", Time.current) }
+      scope :live, -> {
+        unexpired.where(
+          "idle_timeout IS NULL OR last_seen_at IS NULL OR last_seen_at + make_interval(secs => idle_timeout) > ?",
+          Time.current
+        )
+      }
+
+      attr_reader :secret, :seen_before
+
+      class << self
+        def start!(actor:, device: nil, user_agent: nil, ip_address: nil, amr: [], origin: nil, policy: nil,
+                   first_factor: {})
+          secret = SecureRandom.urlsafe_base64(48)
+          lifetime = policy&.session_lifetime&.seconds || LIFETIME
+          now = Time.current
+
+          session = create!(
+            actor: actor,
+            device: device,
+            device_version: device&.version,
+            digest: Digest::SHA256.hexdigest(secret),
+            user_agent: user_agent,
+            ip_address: ip_address,
+            origin: origin.presence || Current.origin,
+            authenticated_at: now,
+            last_seen_at: now,
+            amr: Array(amr),
+            first_factor: first_factor["factor"],
+            provider_id: first_factor["provider_id"],
+            expires_at: now + lifetime,
+            idle_timeout: policy&.session_idle_timeout,
+            bounded: policy.present? && policy.bounds_sessions?
+          )
+
+          session.instance_variable_set(:@secret, secret)
+          actor.active!
+          session
+        end
+
+        def resume(secret)
+          return nil if secret.blank?
+
+          session = unexpired.includes(:device).find_by(digest: Digest::SHA256.hexdigest(secret.to_s))
+
+          return nil unless session&.bound?
+
+          if session.idle?
+            session.expire!
+            return nil
+          end
+
+          session.seen!
+        end
+      end
+
+      def first_factored_by
+        { "factor" => first_factor, "provider_id" => provider_id }.compact
+      end
+
+      def first_factored!(held)
+        return if held["factor"].blank? || held == first_factored_by
+
+        update!(first_factor: held["factor"], provider_id: held["provider_id"])
+      end
+
+      def bound?
+        device.nil? || device.carries?(self)
+      end
+
+      def relying_parties
+        Client
+          .where(id: Token.where(session_id: id).select(:client_id))
+          .where.not(backchannel_logout_uri: [ nil, "" ])
+          .distinct
+      end
+
+      def idle?(now = Time.current)
+        idle_timeout.present? && last_seen_at.present? && last_seen_at <= now - idle_timeout.seconds
+      end
+
+      def idle_for(now = Time.current)
+        now - (seen_before || last_seen_at || authenticated_at)
+      end
+
+      def seen!(now = Time.current)
+        @seen_before = last_seen_at
+
+        update_columns(last_seen_at: now) if last_seen_at.nil? || last_seen_at <= now - SEEN_EVERY
+
+        self
+      end
+
+      def live?(now = Time.current)
+        revoked_at.nil? && expires_at > now && !idle?(now)
+      end
+
+      def expire!
+        return true if revoked_at.present?
+
+        revoke!
+        Event.record!(Event::SESSION_EXPIRED, actor: actor, by: nil, device: device, reason: "idle")
+
+        true
+      end
+
+      def fresh?
+        authenticated_at.present? && authenticated_at > FRESHNESS.ago
+      end
+
+      def revoke!
+        return true if revoked_at.present?
+
+        update!(revoked_at: Time.current)
+        BackchannelLogout.announce(self)
+
+        true
+      end
+    end
+  end
+end

data/app/models/masks/server/sign_in_approval.rb

@@ -0,0 +1,70 @@
+module Masks
+  module Server
+    class SignInApproval < Token
+      VERDICTS = %w[approved denied].freeze
+
+      class << self
+        def lifetime
+          5.minutes
+        end
+
+        def open!(actor:, device:)
+          live.where(actor_id: actor.id, device_id: device&.id).update_all(consumed_at: Time.current)
+
+          code, secret = ConfirmationCode.generate
+
+          [ mint!(actor: actor, device: device, payload: secret), code ]
+        end
+
+        def matching(actor:, code:, from:)
+          waiting.where(actor_id: actor.id).where.not(device_id: from&.id).order(:created_at)
+                 .find { |approval| ConfirmationCode.matches?(approval.payload, code) }
+        end
+
+        def waiting
+          live.where("payload->>'approved_at' IS NULL AND payload->>'denied_at' IS NULL")
+        end
+
+        def approvers?(actor:, except:)
+          DeviceFactor.live.where(actor: actor, factor: DeviceFactor::SECOND_FACTOR)
+                      .where.not(device_id: except&.id).exists?
+        end
+      end
+
+      def approved?
+        held("approved_at").present?
+      end
+
+      def denied?
+        held("denied_at").present?
+      end
+
+      def answered?
+        approved? || denied?
+      end
+
+      def resendable?
+        created_at <= ConfirmationCode::RESEND_AFTER.ago
+      end
+
+      def answer!(verdict, by:)
+        raise ArgumentError, "unknown verdict #{verdict}" unless VERDICTS.include?(verdict)
+
+        with_lock do
+          next false unless live? && !answered?
+
+          update!(payload: payload.merge("#{verdict}_at" => Time.current.iso8601, "#{verdict}_by" => by.id),
+                  consumed_at: verdict == "denied" ? Time.current : nil)
+        end
+      end
+
+      def claim!
+        with_lock do
+          next false unless live? && approved?
+
+          update!(consumed_at: Time.current)
+        end
+      end
+    end
+  end
+end