masks-server 0.7.0

data/app/models/masks/server/single_sign_on.rb

@@ -0,0 +1,262 @@
+module Masks
+  module Server
+    class SingleSignOn
+      class Refused < StandardError
+        attr_reader :warning
+
+        def initialize(warning, message)
+          super(message)
+
+          @warning = warning.to_s
+        end
+      end
+
+      NICKNAME = /\A[a-z0-9][a-z0-9._-]*\z/i
+      SPARE = 500
+
+      attr_reader :provider, :claims, :policy
+
+      def self.resolve!(provider:, claims:, policy: SignInPolicy.default)
+        new(provider: provider, claims: claims, policy: policy).resolve!
+      end
+
+      def initialize(provider:, claims:, policy: SignInPolicy.default)
+        @provider = provider
+        @claims = claims
+        @policy = policy
+      end
+
+      def resolve!
+        refuse! "sso-unavailable", "#{provider.name} cannot sign anybody in" unless provider.signs_in?
+
+        held = Connection.live.find_by(provider: provider, subject: subject)
+
+        return returning(held) if held
+
+        admit!
+
+        matched || provisioned || refuse_unknown!
+      end
+
+      private
+
+        def subject
+          @subject ||= claims["sub"].presence
+        end
+
+        def email
+          return @email if defined?(@email)
+
+          @email = claims["email"].to_s.strip.downcase.presence
+        end
+
+        def claimed_verified?
+          [ true, "true" ].include?(claims["email_verified"])
+        end
+
+        def verified?
+          return false if email.blank?
+          return claimed_verified? if claims.key?("email_verified")
+
+          provider.authoritative_for?(email)
+        end
+
+        def vouched?
+          provider.vouches_for?(email, verified: claimed_verified?)
+        end
+
+        def returning(connection)
+          sync(connection.actor) if provider.delegate?
+
+          link(connection.actor)
+        end
+
+        def admit!
+          return if provider.email_domain_list.empty? && policy.email_domains.empty?
+
+          refuse_unconfirmed! unless verified?
+          refuse_domain! unless provider.welcomes?(email) && policy.admits?(email)
+        end
+
+        def sync(actor)
+          actor.assign_attributes(profile)
+
+          if vouched? && email != actor.email && !Actor.where.not(id: actor.id).exists?(email: email)
+            actor.assign_attributes(email: email, email_verified_at: Time.current)
+          end
+
+          actor.save! if actor.changed?
+        rescue ActiveRecord::RecordInvalid
+          actor.restore_attributes
+        end
+
+        def matched
+          return nil unless verified?
+
+          actor = Actor.find_by(email: email)
+
+          return nil if actor.nil?
+
+          if actor.activated?
+            refuse_unclaimed! unless actor.email_verified_at?
+
+            return { actor: actor, identity: claims, claiming: true }
+          end
+
+          refuse_uninvited! unless vouched?
+
+          return link(actor) if awaited?(actor)
+
+          refuse_unclaimed! unless actor.email_verified_at?
+
+          { actor: actor, identity: claims, claiming: true }
+        end
+
+        def awaited?(actor)
+          Invitation.live.exists?(actor: actor) ||
+            (provider.organization.present? && provider.organization.memberships.exists?(actor: actor))
+        end
+
+        def provisioned
+          return nil unless provider.delegate?
+          return nil if email.present? && !vouched?
+          return nil if email.present? && Actor.exists?(email: email)
+
+          actor = Actor.create!(
+            nickname: nickname,
+            email: email,
+            email_verified_at: (Time.current if email),
+            activated_at: Time.current,
+            scopes: Scopes.join(provider.signup_scope_list),
+            **profile
+          )
+
+          Event.record!(
+            Event::ACTOR_PROVISIONED,
+            actor: actor, by: nil, provider: provider.key, email: email
+          )
+
+          link(actor, fresh: true)
+        rescue ActiveRecord::RecordInvalid, ActiveRecord::RecordNotUnique
+          refuse!("sso-no-account", "an account here already answers for that address")
+        end
+
+        def profile
+          Actor::PROFILE_CLAIMS.each_with_object({}) do |(claim, column), held|
+            next if column == :nickname
+
+            value = claims[claim].presence
+
+            held[column] ||= value if value
+          end
+        end
+
+        def nickname
+          wanted = [ claims["preferred_username"], email&.split("@")&.first, provider.key ]
+            .filter_map { |value| tidy(value) }
+            .first
+
+          return wanted unless Actor.exists?(nickname: wanted)
+
+          spare(wanted) || refuse!("sso-unavailable", "no nickname was free for that account")
+        end
+
+        def tidy(value)
+          held = value.to_s.strip.downcase.gsub(/[^a-z0-9._-]/, "-").gsub(/-+/, "-").delete_prefix("-")
+
+          held.presence && held.match?(NICKNAME) ? held : nil
+        end
+
+        def spare(wanted)
+          (2..SPARE).each do |at|
+            candidate = "#{wanted}#{at}"
+
+            return candidate unless Actor.exists?(nickname: candidate)
+          end
+
+          nil
+        end
+
+        def link(actor, fresh: false)
+          connection = Connection.record!(
+            provider: provider,
+            actor: actor,
+            identity: claims
+          )
+
+          connection.signed_in!
+          enroll!(actor)
+
+          Event.record!(Event::CONNECTION_LINKED, actor: actor, by: nil, provider: provider.key) if fresh || connection.previously_new_record?
+
+          { actor: actor, connection: connection }
+        end
+
+        def enroll!(actor)
+          organization = provider.organization
+
+          return if organization.nil? || organization.archived?
+
+          role = provider.role_from(claims)
+          membership = organization.memberships.find_by(actor: actor)
+
+          return join!(organization, actor, role) if membership.nil?
+
+          membership.accept!(vouched: true)
+          Members.assign!(membership, role: role, by: nil, provider: provider.key)
+        rescue Members::Refused => e
+          Event.record!(Event::MEMBERSHIP_ROLE_KEPT, actor: actor, by: nil, organization: organization,
+                                                     role: membership.role_in_database, wanted: role, provider: provider.key, reason: e.message)
+        end
+
+        def join!(organization, actor, role)
+          Members.enroll!(organization, actor, role: role, by: nil, provider: provider.key)
+        rescue Members::Refused
+          nil
+        end
+
+        def domains
+          (provider.email_domain_list | policy.email_domains).join(", ")
+        end
+
+        def refuse_domain!
+          refuse!(
+            "sso-domain-refused",
+            "#{provider.name} signed in an address outside #{domains}"
+          )
+        end
+
+        def refuse_unconfirmed!
+          refuse!(
+            "sso-unverified",
+            "#{provider.name} confirmed no address, and only #{domains} may sign in"
+          )
+        end
+
+        def refuse_unclaimed!
+          refuse!(
+            "sso-unverified",
+            "an account here holds that address without having confirmed it"
+          )
+        end
+
+        def refuse_uninvited!
+          refuse!(
+            "sso-unauthoritative",
+            "#{provider.name} does not answer for #{email.to_s.split('@').last}, " \
+            "so it cannot take up an invitation waiting there"
+          )
+        end
+
+        def refuse_unknown!
+          return refuse!("sso-unverified", "#{provider.name} did not confirm that address belongs to them") if email && !verified?
+
+          refuse!("sso-no-account", "no account here matches that #{provider.name} sign-in")
+        end
+
+        def refuse!(warning, message)
+          raise Refused.new(warning, message)
+        end
+    end
+  end
+end

data/app/models/masks/server/subject.rb

@@ -0,0 +1,14 @@
+module Masks
+  module Server
+    class Subject < ApplicationRecord
+      include TenantScoped
+
+      belongs_to :actor
+
+      validates :sector, presence: true
+      validates :sub, presence: true, uniqueness: { scope: :tenant_id }
+
+      normalizes :sector, with: ->(value) { value.to_s.strip.downcase.presence }
+    end
+  end
+end

data/app/models/masks/server/subjects.rb

@@ -0,0 +1,39 @@
+module Masks
+  module Server
+    module Subjects
+      PUBLIC = "public".freeze
+      PAIRWISE = "pairwise".freeze
+      TYPES = [ PUBLIC, PAIRWISE ].freeze
+      UUID = /\A[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}\z/i
+
+      class << self
+        def for(actor, client)
+          return nil if actor.nil?
+          return actor.uuid unless client&.pairwise?
+
+          sector = Subject.normalize_value_for(
+            :sector, client.sector_identifier.presence || client.client_id
+          )
+
+          Subject.find_by(actor_id: actor.id, sector: sector)&.sub ||
+            Subject.create!(actor: actor, sector: sector, sub: derive(actor, sector)).sub
+        rescue ActiveRecord::RecordNotUnique
+          Subject.find_by!(actor_id: actor.id, sector: sector).sub
+        end
+
+        def locate(sub)
+          return nil if sub.blank?
+          return Actor.find_by(uuid: sub) if sub.match?(UUID)
+
+          Actor.joins(:subjects).find_by(subjects: { sub: sub })
+        end
+
+        def derive(actor, sector)
+          digest = OpenSSL::Digest::SHA256.digest("#{sector}#{actor.uuid}#{actor.tenant.pairwise_salt!}")
+
+          Base64.urlsafe_encode64(digest, padding: false)
+        end
+      end
+    end
+  end
+end