masks-server 0.7.0

data/app/models/masks/server/sign_in_policy.rb

@@ -0,0 +1,202 @@
+module Masks
+  module Server
+    class SignInPolicy < ApplicationRecord
+      include TenantScoped
+      include Archivable
+
+      OFF = "off".freeze
+      OPTIONAL = "optional".freeze
+      REQUIRED = "required".freeze
+      PRESENCE = [ OFF, OPTIONAL, REQUIRED ].freeze
+
+      FIRST_FACTORS = %w[password passkey provider email_code].freeze
+      IDENTIFYING = %w[password passkey email_code].freeze
+      SECOND_FACTORS = %w[otp passkey backup_codes email sms trusted_device].freeze
+
+      NONE = "none".freeze
+      CODE = "code".freeze
+      LINK = "link".freeze
+      APPROVAL = "approval".freeze
+      CONFIRMATIONS = [ NONE, CODE, LINK, APPROVAL ].freeze
+
+      SHORTEST_SESSION = 5.minutes
+      LONGEST_SESSION = 400.days
+
+      has_many :clients, dependent: :nullify
+      has_many :organizations, dependent: :nullify
+
+      validates :key, presence: true,
+                      uniqueness: { scope: :tenant_id },
+                      format: { with: /\A[a-z0-9][a-z0-9-]*\z/ }
+      validates :name, presence: true
+      validates :nickname, :email, :phone, inclusion: { in: PRESENCE }
+      validates :confirmation, inclusion: { in: CONFIRMATIONS }
+      validates :password_minimum, numericality: { only_integer: true, in: Actor::MINIMUM_PASSWORD..256 }
+      validates :session_lifetime, :session_idle_timeout,
+                numericality: { only_integer: true, in: SHORTEST_SESSION.to_i..LONGEST_SESSION.to_i },
+                allow_nil: true
+      validate :idle_fits_the_lifetime
+      validates :proof_of_work, numericality: { only_integer: true, in: 0..ProofOfWork::HARDEST }
+      validates :risk_step_up_at, :risk_refuse_at, numericality: { only_integer: true, in: 1..Risk::MOST }, allow_nil: true
+      validate :refusing_is_stricter
+      validate :factors_are_known
+      validate :something_names_an_account
+      validate :confirmation_has_somewhere_to_go
+      validate :hiding_needs_a_code
+      validate :signup_scopes_stay_ordinary
+      validate :a_default_keeps_a_local_way_in
+      validate :a_required_password_is_offered
+
+      normalizes :email_domains, with: ->(held) {
+        Array(held).map { |one| one.to_s.strip.downcase.delete_prefix("@") }.reject(&:empty?).uniq
+      }
+
+      class << self
+        def default
+          new(key: "default", name: "Default")
+        end
+
+        def first_run
+          new(key: "first-run", name: "First run", signup: true, nickname: REQUIRED, email: REQUIRED, phone: OFF,
+              proof_of_work: 0)
+        end
+
+        def for(client: nil, tenant: Current.tenant, organization: nil)
+          [ organization&.sign_in_policy, client&.sign_in_policy, tenant&.sign_in_policy ]
+            .compact.find { |policy| !policy.archived? } || default
+        end
+      end
+
+      def bounds_sessions?
+        session_lifetime.present? || session_idle_timeout.present?
+      end
+
+      def asks?(field)
+        public_send(field) != OFF
+      end
+
+      def requires?(field)
+        public_send(field) == REQUIRED
+      end
+
+      def first_factor?(factor)
+        first_factors.include?(factor.to_s)
+      end
+
+      def admits_first_factor?(factor, provider: nil)
+        return false unless first_factor?(factor)
+
+        factor.to_s != "provider" || (provider.present? && offers?(provider))
+      end
+
+      def identifies?
+        IDENTIFYING.any? { |factor| first_factor?(factor) }
+      end
+
+      def local?
+        first_factor?(:password) || first_factor?(:passkey)
+      end
+
+      def second_factor?(factor)
+        second_factors.include?(factor.to_s)
+      end
+
+      def admits?(email)
+        return true if email_domains.empty?
+
+        domain = email.to_s.split("@").last.to_s.downcase
+
+        email_domains.include?(domain)
+      end
+
+      def offers?(provider)
+        providers.nil? || providers.include?(provider.key)
+      end
+
+      def passkey_signup?
+        first_factor?(:passkey) && !password_required
+      end
+
+      def proves_work?
+        signup && proof_of_work.to_i.positive?
+      end
+
+      def signup_scope_list
+        signup_scopes.present? ? Scopes.list(signup_scopes) : Scopes::STANDARD
+      end
+
+      private
+
+        def factors_are_known
+          errors.add(:first_factors, "must include at least one way to sign in") if first_factors.blank?
+
+          unknown = Array(first_factors) - FIRST_FACTORS
+          errors.add(:first_factors, "does not know #{unknown.join(', ')}") if unknown.any?
+
+          unknown = Array(second_factors) - SECOND_FACTORS
+          errors.add(:second_factors, "does not know #{unknown.join(', ')}") if unknown.any?
+
+          if (second_factor_required || apps_require_second_factor) &&
+             (Array(second_factors) - %w[backup_codes trusted_device]).empty?
+            errors.add(:second_factors, "must offer more than backup codes when one is required")
+          end
+        end
+
+        def refusing_is_stricter
+          return unless risk_step_up_at && risk_refuse_at
+
+          errors.add(:risk_refuse_at, "must be higher than the score that asks for a second factor") if risk_refuse_at <= risk_step_up_at
+        end
+
+        def idle_fits_the_lifetime
+          return unless session_lifetime && session_idle_timeout
+
+          errors.add(:session_idle_timeout, "must be shorter than the session lifetime") if session_idle_timeout >= session_lifetime
+        end
+
+        def something_names_an_account
+          if nickname == OFF && email == OFF
+            errors.add(:base, "An account needs a nickname or an email")
+          end
+
+          case tenant&.named_by
+          when Tenant::NICKNAME
+            errors.add(:nickname, "is required, because this tenant names accounts by nickname") unless requires?(:nickname)
+          when Tenant::EMAIL
+            errors.add(:email, "is required, because this tenant names accounts by email") unless requires?(:email)
+          end
+        end
+
+        def confirmation_has_somewhere_to_go
+          return unless [ CODE, LINK ].include?(confirmation)
+
+          errors.add(:confirmation, "by email needs the email to be required") unless requires?(:email)
+        end
+
+        def hiding_needs_a_code
+          return unless hidden
+
+          errors.add(:hidden, "needs the email to be required") unless requires?(:email)
+        end
+
+        def a_default_keeps_a_local_way_in
+          return if local? || !persisted?
+          return unless Tenant.exists?(sign_in_policy_id: id)
+
+          errors.add(:first_factors, "must keep a password or a passkey while this is the tenant's default, so managers are never locked out")
+        end
+
+        def a_required_password_is_offered
+          return unless password_required && !first_factor?(:password)
+
+          errors.add(:password_required, "needs passwords among the ways to sign in")
+        end
+
+        def signup_scopes_stay_ordinary
+          reserved = Scopes.reserved(signup_scopes)
+
+          errors.add(:signup_scopes, "may not include #{Scopes.join(reserved)}") if reserved.any?
+        end
+    end
+  end
+end

data/app/models/masks/server/signal_stream.rb

@@ -0,0 +1,147 @@
+module Masks
+  module Server
+    class SignalStream < ApplicationRecord
+      class Refused < StandardError; end
+
+      include TenantScoped
+
+      PUSH = "urn:ietf:rfc:8935".freeze
+      ENABLED = "enabled".freeze
+      PAUSED = "paused".freeze
+      DISABLED = "disabled".freeze
+      STATUSES = [ ENABLED, PAUSED, DISABLED ].freeze
+      ATTEMPTS = 8
+      TOKEN_TYPE = "secevent+jwt".freeze
+
+      belongs_to :client
+
+      encrypts :authorization_header
+
+      validates :client_id, uniqueness: true
+      validates :status, inclusion: { in: STATUSES }
+      validates :issuer, presence: true
+      validate :endpoint_is_callable
+      validate :events_are_supported
+
+      before_validation { self.events_requested = Array(events_requested).map(&:to_s).uniq }
+
+      class << self
+        def raised(event)
+          signal = Signals.for(event)
+
+          return if signal.nil? || event.actor.nil?
+
+          where(status: ENABLED).includes(:client).find_each do |stream|
+            next unless stream.delivers?(signal.type) && stream.follows?(event.actor, organization: Signals.organization_of(event))
+
+            SignalJob.perform_later(stream.id, event_id: event.id)
+          end
+        end
+      end
+
+      def delivered_events
+        events_requested & Signals::TYPES
+      end
+
+      def delivers?(type)
+        receiving? && delivered_events.include?(type)
+      end
+
+      def receiving?
+        !client.archived? && client.unattended_scopes.include?(Scopes::SIGNALS)
+      end
+
+      def follows?(actor, organization: nil)
+        return false if forsaken_by?(actor)
+        return client.tokens.where("expires_at > ?", Time.current).exists?(actor: actor, organization: organization) if organization
+
+        client.consents.live.exists?(actor: actor) || client.tokens.live.exists?(actor: actor)
+      end
+
+      def forsaken_by?(actor)
+        client.consents.exists?(actor: actor) && !client.consents.live.exists?(actor: actor)
+      end
+
+      def configuration
+        {
+          "stream_id" => uuid,
+          "iss" => issuer,
+          "aud" => client.client_id,
+          "delivery" => { "method" => PUSH, "endpoint_url" => endpoint_url },
+          "events_supported" => Signals::TYPES,
+          "events_requested" => events_requested,
+          "events_delivered" => delivered_events,
+          "description" => description
+        }.compact
+      end
+
+      def state
+        { "stream_id" => uuid, "status" => status, "reason" => status_reason }.compact
+      end
+
+      def security_event_token(event)
+        signal = Signals.for(event)
+
+        sign({ signal.type => signal.payload(event) }, subject: subject_for(event.actor), at: event.created_at)
+      end
+
+      def verification_token(state)
+        sign({ Signals::VERIFICATION => { "state" => state.presence }.compact }, subject: { "format" => "opaque", "id" => uuid })
+      end
+
+      def deliver!(token)
+        uri = URI.parse(endpoint_url)
+        headers = { "Content-Type" => "application/#{TOKEN_TYPE}", "Accept" => "application/json" }
+        headers["Authorization"] = authorization_header if authorization_header.present?
+
+        response = Outbound.post_json(uri, token, headers: headers, address: routable!(uri))
+
+        return update_columns(last_delivered_at: Time.current, last_failure: nil) if response.is_a?(Net::HTTPSuccess)
+
+        raise Refused, "#{client.name} answered #{response.code}"
+      rescue *Outbound::UNREADABLE, URI::InvalidURIError => e
+        raise Refused, "#{client.name} could not be reached: #{e.class}"
+      end
+
+      def failed!(message)
+        update_columns(last_failure: message.to_s.truncate(255))
+      end
+
+      private
+
+        def sign(events, subject:, at: Time.current)
+          Issuer.new(tenant, issuer).sign({
+            "iss" => issuer,
+            "aud" => client.client_id,
+            "jti" => SecureRandom.uuid,
+            "iat" => Time.current.to_i,
+            "txn" => at.to_i.to_s,
+            "sub_id" => subject,
+            "events" => events
+          }, typ: TOKEN_TYPE)
+        end
+
+        def subject_for(actor)
+          { "format" => "iss_sub", "iss" => issuer, "sub" => Subjects.for(actor, client) }
+        end
+
+        def routable!(uri)
+          return if ::Rails.env.local?
+
+          Outbound.vetted(uri) || raise(Refused, "#{client.name} resolves to an address this server will not call")
+        end
+
+        def endpoint_is_callable
+          problem = Outbound.problem_with(endpoint_url)
+
+          errors.add(:endpoint_url, problem) if problem
+        end
+
+        def events_are_supported
+          unknown = events_requested - Signals::TYPES
+
+          errors.add(:events_requested, "include events this transmitter does not send: #{unknown.join(', ')}") if unknown.any?
+        end
+    end
+  end
+end

data/app/models/masks/server/signals.rb

@@ -0,0 +1,72 @@
+module Masks
+  module Server
+    module Signals
+      CAEP = "https://schemas.openid.net/secevent/caep/event-type/".freeze
+      RISC = "https://schemas.openid.net/secevent/risc/event-type/".freeze
+
+      SESSION_REVOKED = "#{CAEP}session-revoked".freeze
+      CREDENTIAL_CHANGE = "#{CAEP}credential-change".freeze
+      TOKEN_CLAIMS_CHANGE = "#{CAEP}token-claims-change".freeze
+      ACCOUNT_DISABLED = "#{RISC}account-disabled".freeze
+      ACCOUNT_ENABLED = "#{RISC}account-enabled".freeze
+      VERIFICATION = "https://schemas.openid.net/secevent/ssf/event-type/verification".freeze
+
+      TYPES = [ SESSION_REVOKED, CREDENTIAL_CHANGE, TOKEN_CLAIMS_CHANGE, ACCOUNT_DISABLED, ACCOUNT_ENABLED ].freeze
+
+      Signal = Data.define(:type, :details) do
+        def payload(event)
+          caep = type.start_with?(CAEP)
+
+          (details.respond_to?(:call) ? details.call(event) : details).merge(
+            "event_timestamp" => (event.created_at.to_i if caep),
+            "initiating_entity" => (Signals.initiator(event) if caep)
+          ).compact
+        end
+      end
+
+      MAPPED = {
+        Event::SESSION_REVOKED => Signal.new(SESSION_REVOKED, {}),
+        Event::ACTOR_SIGNED_OUT => Signal.new(SESSION_REVOKED, {}),
+        Event::PASSWORD_CHANGED => Signal.new(CREDENTIAL_CHANGE, { "credential_type" => "password", "change_type" => "update" }),
+        Event::PASSWORD_RESET_COMPLETED => Signal.new(CREDENTIAL_CHANGE, { "credential_type" => "password", "change_type" => "update" }),
+        Event::PASSKEY_ADDED => Signal.new(CREDENTIAL_CHANGE, { "credential_type" => "fido2-platform", "change_type" => "create" }),
+        Event::PASSKEY_REMOVED => Signal.new(CREDENTIAL_CHANGE, { "credential_type" => "fido2-platform", "change_type" => "delete" }),
+        Event::AUTHENTICATOR_ENABLED => Signal.new(CREDENTIAL_CHANGE, { "credential_type" => "app", "change_type" => "create" }),
+        Event::AUTHENTICATOR_DISABLED => Signal.new(CREDENTIAL_CHANGE, { "credential_type" => "app", "change_type" => "delete" }),
+        Event::ACTOR_SUSPENDED => Signal.new(ACCOUNT_DISABLED, {}),
+        Event::ACTOR_RESTORED => Signal.new(ACCOUNT_ENABLED, {}),
+        Event::MEMBERSHIP_ROLE_CHANGED => Signal.new(TOKEN_CLAIMS_CHANGE, ->(event) { Signals.reorganized(event) }),
+        Event::MEMBERSHIP_REMOVED => Signal.new(SESSION_REVOKED, {}),
+        Event::MEMBERSHIP_SUSPENDED => Signal.new(SESSION_REVOKED, {})
+      }.freeze
+
+      ORGANIZATIONAL = [ Event::MEMBERSHIP_ROLE_CHANGED, Event::MEMBERSHIP_REMOVED, Event::MEMBERSHIP_SUSPENDED ].freeze
+
+      class << self
+        def for(event)
+          MAPPED[event.action]
+        end
+
+        def organization_of(event)
+          event.organization if ORGANIZATIONAL.include?(event.action)
+        end
+
+        def reorganized(event)
+          organization = event.organization
+
+          return {} if organization.nil?
+
+          { "claims" => { "org" => { "id" => organization.uuid, "key" => organization.key,
+                                     "name" => organization.name, "role" => event.details["now"] } } }
+        end
+
+        def initiator(event)
+          if event.by_id.nil? then "system"
+          elsif event.by_id == event.actor_id then "user"
+          else "admin"
+          end
+        end
+      end
+    end
+  end
+end

data/app/models/masks/server/signing_key.rb

@@ -0,0 +1,112 @@
+module Masks
+  module Server
+    class SigningKey < ApplicationRecord
+      include TenantScoped
+
+      SIZE = 2048
+      ALGORITHM = "RS256".freeze
+      OVERLAP = 24.hours
+
+      encrypts :private_pem
+
+      scope :active, -> { where(retired_at: nil).where.not(activated_at: nil).order(activated_at: :desc) }
+      scope :staged, -> { where(activated_at: nil, retired_at: nil).order(created_at: :desc) }
+      scope :published, -> { where("retired_at IS NULL OR retired_at > ?", Time.current).order(activated_at: :desc) }
+
+      class << self
+        attr_writer :generator
+
+        def generator
+          @generator ||= -> { OpenSSL::PKey::RSA.generate(SIZE) }
+        end
+
+        def generate!(tenant:, activate: true)
+          rsa = generator.call
+          kid = SecureRandom.uuid
+
+          create!(
+            tenant: tenant,
+            kid: kid,
+            algorithm: ALGORITHM,
+            private_pem: rsa.to_pem,
+            public_jwk: jwk_for(rsa.public_key, kid),
+            activated_at: (Time.current if activate)
+          ).tap(&:certificate)
+        end
+
+        def stage!(tenant:)
+          generate!(tenant: tenant, activate: false)
+        end
+
+        def rotate!(tenant:)
+          stage!(tenant: tenant).activate!
+        end
+
+        def jwk_for(public_key, kid)
+          {
+            "kty" => "RSA",
+            "use" => "sig",
+            "alg" => ALGORITHM,
+            "kid" => kid,
+            "n" => Base64.urlsafe_encode64(public_key.n.to_s(2), padding: false),
+            "e" => Base64.urlsafe_encode64(public_key.e.to_s(2), padding: false)
+          }
+        end
+      end
+
+      def private_key
+        @private_key ||= OpenSSL::PKey::RSA.new(private_pem)
+      end
+
+      def certificate
+        @certificate ||= if certificate_pem.present?
+          OpenSSL::X509::Certificate.new(certificate_pem)
+        else
+          self_signed.tap { |issued| update_column(:certificate_pem, issued.to_pem) }
+        end
+      end
+
+      def sign(claims, typ: "JWT")
+        JWT.encode(claims, private_key, algorithm, kid: kid, typ: typ)
+      end
+
+      def activate!
+        transaction do
+          update!(activated_at: Time.current)
+          self.class.active.where.not(id: id).update_all(retired_at: OVERLAP.from_now)
+        end
+
+        self
+      end
+
+      def staged?
+        activated_at.nil? && retired_at.nil?
+      end
+
+      def active?
+        activated_at.present? && retired_at.nil?
+      end
+
+      def retired?
+        retired_at.present? && retired_at <= Time.current
+      end
+
+      private
+
+        def self_signed
+          name = OpenSSL::X509::Name.new([ [ "CN", "#{tenant.subdomain} masks" ], [ "O", tenant.name.to_s.presence || tenant.subdomain ] ])
+
+          OpenSSL::X509::Certificate.new.tap do |certificate|
+            certificate.version = 2
+            certificate.serial = OpenSSL::BN.new(Digest::SHA256.hexdigest(kid)[0, 30], 16)
+            certificate.subject = name
+            certificate.issuer = name
+            certificate.public_key = private_key.public_key
+            certificate.not_before = (activated_at || created_at || Time.current) - 1.day
+            certificate.not_after = certificate.not_before + 10.years
+            certificate.sign(private_key, OpenSSL::Digest.new("SHA256"))
+          end
+        end
+    end
+  end
+end