masks-server 0.7.0

data/app/models/masks/server/token.rb

@@ -0,0 +1,183 @@
+module Masks
+  module Server
+    class Token < ApplicationRecord
+      include TenantScoped
+
+      KINDS = {
+        "access" => "AccessToken",
+        "refresh" => "RefreshToken",
+        "code" => "AuthorizationCode",
+        "device" => "DeviceGrant",
+        "invitation" => "Invitation",
+        "provisioning" => "ProvisioningToken",
+        "ldap" => "LdapCredential",
+        "handshake" => "PendingHandshake",
+        "email_verification" => "EmailVerification",
+        "password_reset" => "PasswordReset",
+        "confirmation" => "ConfirmationCode",
+        "initial_access" => "InitialAccessToken",
+        "request" => "PendingRequest",
+        "login" => "PendingLogin",
+        "pushed" => "PushedRequest",
+        "approval" => "SignInApproval",
+        "forward_code" => "ForwardCode",
+        "forward_session" => "ForwardSession"
+      }.freeze
+
+      self.inheritance_column = "kind"
+
+      belongs_to :actor, optional: true
+      belongs_to :client, optional: true
+      belongs_to :device, optional: true
+      belongs_to :session, optional: true
+      belongs_to :organization, optional: true
+      belongs_to :parent, class_name: "Token", optional: true
+
+      has_many :children, class_name: "Token", foreign_key: :parent_id, dependent: :nullify
+
+      before_create { self.root_id ||= parent && (parent.root_id || parent.id) }
+
+      scope :live, -> { where(consumed_at: nil).where("expires_at > ?", Time.current) }
+      scope :ended_before, ->(cutoff) { where("LEAST(consumed_at, expires_at) < ?", cutoff) }
+
+      attr_reader :secret
+
+      class << self
+        def sti_name
+          KINDS.key(name.demodulize) || raise(ArgumentError, "#{name} has no token kind")
+        end
+
+        def find_sti_class(kind)
+          class_name = KINDS.fetch(kind) { raise ActiveRecord::SubclassNotFound, "no token kind called #{kind}" }
+
+          module_parent.const_get(class_name, false)
+        end
+
+        def lifetime
+          10.minutes
+        end
+
+        def mint!(**attributes)
+          secret = SecureRandom.urlsafe_base64(48)
+          attributes[:device] ||= attributes[:parent]&.device
+          attributes[:session] ||= attributes[:parent]&.session
+          attributes[:organization] ||= attributes[:parent]&.organization
+
+          token = create!(
+            **attributes,
+            digest: Digest::SHA256.hexdigest(secret),
+            expires_at: attributes[:expires_at] || lifetime.from_now
+          )
+
+          token.instance_variable_set(:@secret, secret)
+          token
+        end
+
+        def redeem(secret)
+          return nil if secret.blank?
+
+          live.find_by(digest: Digest::SHA256.hexdigest(secret.to_s))
+        end
+
+        def spent(secret)
+          return nil if secret.blank?
+
+          find_by(digest: Digest::SHA256.hexdigest(secret.to_s))
+        end
+
+        def families(roots)
+          where(id: roots).or(where(root_id: roots))
+        end
+
+        def claim(secret)
+          return nil if secret.blank?
+
+          digest = Digest::SHA256.hexdigest(secret.to_s)
+          now = Time.current
+          taken = live.where(digest: digest).update_all(consumed_at: now, updated_at: now)
+
+          taken.zero? ? nil : find_by(digest: digest)
+        end
+      end
+
+      def consume!
+        update!(consumed_at: Time.current)
+      end
+
+      def revoke!
+        transaction do
+          revoked = 0
+          frontier = [ self ]
+
+          while (token = frontier.shift)
+            next if token.consumed?
+
+            token.update!(consumed_at: Time.current)
+            revoked += 1
+            frontier.concat(token.children.to_a)
+          end
+
+          revoked
+        end
+      end
+
+      def subject(issuer)
+        actor ? issuer.subject_for(actor, client) : root.client&.client_id
+      end
+
+      def organization_claim
+        organization&.claim_for(actor)
+      end
+
+      def root
+        root_id ? Token.find(root_id) : self
+      end
+
+      def family
+        Token.families(root_id || id)
+      end
+
+      def revoke_family!
+        transaction do
+          revoked = family.live.count
+          now = Time.current
+          family.where(consumed_at: nil).update_all(consumed_at: now, updated_at: now)
+
+          revoked
+        end
+      end
+
+      def consumed?
+        consumed_at.present?
+      end
+
+      def live?
+        !consumed? && expires_at > Time.current
+      end
+
+      def expires_in
+        [ (expires_at - Time.current).to_i, 0 ].max
+      end
+
+      def scope_list
+        Scopes.list(scopes)
+      end
+
+      def held(key)
+        (payload || {})[key]
+      end
+
+      def bound?
+        jkt.present?
+      end
+
+      def confirmation
+        { "jkt" => jkt } if bound?
+      end
+
+      def bound_to?(proof)
+        proof.present? && ActiveSupport::SecurityUtils.secure_compare(jkt.to_s, proof.jkt.to_s)
+      end
+    end
+  end
+end

data/app/models/masks/server/user_codes.rb

@@ -0,0 +1,32 @@
+module Masks
+  module Server
+    module UserCodes
+      ALPHABET = "BCDFGHJKLMNPQRSTVWXZ".chars.freeze
+      LENGTH = 8
+      GROUP = 4
+
+      class << self
+        def generate
+          Array.new(LENGTH) { ALPHABET[SecureRandom.random_number(ALPHABET.length)] }.join
+        end
+
+        def spaced(code)
+          code.to_s.scan(/.{1,#{GROUP}}/).join("-")
+        end
+
+        def read(value)
+          held = value.to_s.upcase.gsub(/[^A-Z]/, "")
+
+          return nil unless held.length == LENGTH
+          return nil unless held.chars.all? { |letter| ALPHABET.include?(letter) }
+
+          held
+        end
+
+        def digest(code)
+          Digest::SHA256.hexdigest(code.to_s)
+        end
+      end
+    end
+  end
+end

data/app/models/masks/server/verifications.rb

@@ -0,0 +1,26 @@
+module Masks
+  module Server
+    module Verifications
+      def self.open(actor:, journey:)
+        return { delivered: false, url: nil } unless pending?(actor)
+
+        by = journey.by
+        verification = EmailVerification.open!(actor: actor, by: by)
+
+        Event.record!(Event::EMAIL_VERIFICATION_SENT, actor: actor, by: by, email: actor.email)
+
+        return { delivered: false, url: verification.url(Current.origin) } unless ActorMailer.deliverable?
+
+        ActorMailer.email_verification(actor, verification.url(Current.origin), journey: journey).deliver_later
+
+        verification.delivered!
+
+        { delivered: true, url: nil }
+      end
+
+      def self.pending?(actor)
+        actor.present? && actor.email.present? && actor.email_verified_at.nil?
+      end
+    end
+  end
+end

data/app/policies/masks/server/authorization_policy.rb

@@ -0,0 +1,55 @@
+module Masks
+  module Server
+    class AuthorizationPolicy < Policy
+      include GrantChecks
+
+      uses ClientPolicy
+      checks :response_type_is_supported,
+             :client_may_use_the_code_grant,
+             :pkce_is_present_when_required,
+             :challenge_method_is_supported,
+             :scopes_are_permitted,
+             :resources_are_absolute,
+             :authorization_details_are_permitted
+
+      delegate :client, :response_type, :requested_scopes, :granted_scopes,
+               :code_challenge, :code_challenge_method, :audience, :authorization_details, to: :subject
+
+      private
+
+        def response_type_is_supported
+          unless Client::RESPONSE_TYPES.include?(response_type)
+            deny!("unsupported_response_type",
+                  "only #{Client::RESPONSE_TYPES.join(', ')} is supported",
+                  redirectable: true)
+          end
+        end
+
+        def client_may_use_the_code_grant
+          unless client.grants?("authorization_code")
+            deny!("unauthorized_client",
+                  "this client is not registered for the authorization_code grant",
+                  redirectable: true)
+          end
+        end
+
+        def pkce_is_present_when_required
+          if client.public? && code_challenge.blank?
+            deny!("invalid_request",
+                  "a public client must send code_challenge",
+                  redirectable: true)
+          end
+        end
+
+        def challenge_method_is_supported
+          return if code_challenge.blank?
+
+          unless Client::CHALLENGE_METHODS.include?(code_challenge_method)
+            deny!("invalid_request",
+                  "code_challenge_method must be #{Client::CHALLENGE_METHODS.join(' or ')}",
+                  redirectable: true)
+          end
+        end
+    end
+  end
+end

data/app/policies/masks/server/client_policy.rb

@@ -0,0 +1,21 @@
+module Masks
+  module Server
+    class ClientPolicy < Policy
+      include GrantChecks
+
+      checks :client_is_known, :redirect_uri_is_registered
+
+      delegate :client, :redirect_uri, to: :subject
+
+      private
+
+        def redirect_uri_is_registered
+          if redirect_uri.blank?
+            deny!("invalid_request", "redirect_uri is required")
+          elsif !client.redirect_uri?(redirect_uri)
+            deny!("invalid_request", "redirect_uri is not registered for this client")
+          end
+        end
+    end
+  end
+end

data/app/policies/masks/server/device_policy.rb

@@ -0,0 +1,22 @@
+module Masks
+  module Server
+    class DevicePolicy < Policy
+      include GrantChecks
+
+      checks :client_is_known,
+             :client_may_use_the_device_grant,
+             :scopes_are_permitted,
+             :resources_are_absolute
+
+      delegate :client, :requested_scopes, :granted_scopes, :audience, to: :subject
+
+      private
+
+        def client_may_use_the_device_grant
+          unless client.grants?(DeviceGrant::GRANT_TYPE)
+            deny!("unauthorized_client", "this client is not registered for the device grant")
+          end
+        end
+    end
+  end
+end

data/app/policies/masks/server/exchange_policy.rb

@@ -0,0 +1,155 @@
+module Masks
+  module Server
+    class ExchangePolicy < Policy
+      checks :client_may_exchange,
+             :token_types_are_supported,
+             :subject_token_is_live,
+             :id_token_belongs_to_the_client,
+             :actor_token_is_held,
+             :bound_tokens_are_proven,
+             :scopes_only_narrow,
+             :scopes_stay_within_the_client,
+             :audience_only_narrows,
+             :authorization_details_only_narrow,
+             :lifetime_only_shortens,
+             :upstream_is_releasable
+
+      delegate :client, :subject, :acting, :actor, :subject_token_type, :actor_token, :actor_token_type,
+               :requested_token_type, :requested_scopes, :requested_audience, :available_scopes, :available_audience,
+               :requested_lifetime, :named_audience, :upstream?, :connection, :delegation,
+               :requested_authorization_details, :available_authorization_details, :unproven, to: :exchange
+
+      private
+
+        def exchange
+          @subject
+        end
+
+        def client_may_exchange
+          unless client.grants?(Exchange::GRANT_TYPE)
+            deny!("unauthorized_client", "this client is not registered for token exchange")
+          end
+        end
+
+        def token_types_are_supported
+          unless Exchange::TOKEN_TYPES.include?(subject_token_type)
+            deny!("invalid_request", "subject_token_type must be #{Exchange::TOKEN_TYPES.join(' or ')}")
+          end
+
+          if actor_token && !Exchange::TOKEN_TYPES.include?(actor_token_type.to_s)
+            deny!("invalid_request", "actor_token_type must be #{Exchange::TOKEN_TYPES.join(' or ')}")
+          end
+
+          deny!("invalid_request", "actor_token_type is only sent beside an actor_token") if actor_token_type && actor_token.nil?
+
+          unless Exchange::REQUESTED_TOKEN_TYPES.include?(requested_token_type)
+            deny!("invalid_request", "requested_token_type must be #{Exchange::REQUESTED_TOKEN_TYPES.join(' or ')}")
+          end
+
+          if named_audience.any? && !upstream?
+            deny!("invalid_target", "audience names a connection, which only an upstream token is released for")
+          end
+
+          if upstream? && subject_token_type != Exchange::ACCESS_TOKEN
+            deny!("invalid_request", "an upstream token is only released for an access token")
+          end
+        end
+
+        def subject_token_is_live
+          deny!("invalid_grant", "subject_token could not be verified") if subject.nil?
+          deny!("invalid_grant", "subject_token has been revoked or has expired") unless subject.live?
+        end
+
+        def id_token_belongs_to_the_client
+          return unless subject.id_token?
+
+          deny!("unauthorized_client", "a client that cannot authenticate does not exchange id tokens") if client.public?
+          deny!("invalid_grant", "an id token is exchanged only by the client it was issued to") unless subject.held_by?(client)
+        end
+
+        def actor_token_is_held
+          return if actor_token.nil?
+
+          deny!("invalid_grant", "actor_token could not be verified") if acting.nil?
+          deny!("invalid_grant", "actor_token has been revoked or has expired") unless acting.live?
+          deny!("invalid_grant", "actor_token has to be one issued to the client presenting it") unless acting.held_by?(client)
+        end
+
+        def bound_tokens_are_proven
+          held = unproven
+          return if held.nil?
+
+          name = held.equal?(acting) ? "actor_token" : "subject_token"
+
+          deny!("invalid_dpop_proof", "#{name} is held to a key, and this request carries no proof made with it")
+        end
+
+        def scopes_stay_within_the_client
+          beyond = Scopes.refused(client.scope_list, requested_scopes)
+
+          deny!("invalid_scope", "this client may not hold #{beyond.join(', ')}") if beyond.any?
+        end
+
+        def scopes_only_narrow
+          widened = Scopes.refused(available_scopes, requested_scopes)
+
+          if widened.any?
+            deny!("invalid_scope",
+                  "an exchange cannot widen scope: #{widened.join(', ')} is not carried by the subject token")
+          end
+        end
+
+        def audience_only_narrows
+          widened = requested_audience - available_audience
+
+          if widened.any?
+            deny!("invalid_target",
+                  "an exchange cannot widen audience: #{widened.join(', ')} is not carried by the subject token")
+          end
+        end
+
+        def authorization_details_only_narrow
+          return if requested_authorization_details.nil?
+
+          deny!("invalid_request", "an upstream token is released without authorization_details") if upstream?
+
+          AuthorizationDetails.narrow!(requested_authorization_details.as_json, available_authorization_details)
+        rescue AuthorizationDetails::Invalid => e
+          deny!("invalid_authorization_details", e.message)
+        end
+
+        def lifetime_only_shortens
+          return if requested_lifetime.nil?
+
+          deny!("invalid_request", "requested lifetime must be positive") unless requested_lifetime.positive?
+        end
+
+        def upstream_is_releasable
+          return unless upstream?
+
+          access = subject.record
+
+          if requested_scopes.any? || requested_audience.any? || requested_lifetime
+            deny!("invalid_request", "an upstream token is released as the connection holds it, without scope, resource or lifetime")
+          end
+
+          deny!("invalid_grant", "subject_token was issued to another client") unless access.client_id == client.id
+          deny!("unauthorized_client", "only an approved client can be released somebody's account elsewhere") unless client.approved?
+          deny!("invalid_target", "audience has to name exactly one connection") if connection.nil?
+
+          if actor.nil? || connection.revoked? || connection.actor_id != actor.id
+            deny!("invalid_grant", "that connection is not live for the person this token speaks for")
+          end
+
+          deny!("invalid_grant", "#{connection.provider.name} no longer lets applications use it") unless connection.provider.delegating?
+
+          scope = connection.provider.delegation_scope
+          deny!("insufficient_scope", "subject_token does not carry #{scope}") unless access.scope_list.include?(scope)
+
+          return if delegation
+
+          deny!("invalid_grant", "#{actor&.identifier || 'that person'} has not let this client use that connection")
+        end
+    end
+  end
+end

data/app/policies/masks/server/grant_checks.rb

@@ -0,0 +1,45 @@
+module Masks
+  module Server
+    module GrantChecks
+      private
+
+        def client_is_known
+          deny!("invalid_client", "no client is registered with that client_id") if client.nil?
+        end
+
+        def scopes_are_permitted
+          refused = Scopes.refused(client.scope_list, requested_scopes)
+
+          if refused.any?
+            deny!("invalid_scope",
+                  "this client may not request #{refused.join(', ')}",
+                  redirectable: true)
+          end
+
+          if granted_scopes.empty?
+            deny!("invalid_scope", "no scope was requested", redirectable: true)
+          end
+        end
+
+        def authorization_details_are_permitted
+          authorization_details&.check!(client)
+        rescue AuthorizationDetails::Invalid => e
+          deny!("invalid_authorization_details", e.message, redirectable: true)
+        end
+
+        def resources_are_absolute
+          audience.each do |value|
+            uri = URI.parse(value)
+
+            if uri.scheme.blank? || uri.host.blank? || uri.fragment.present?
+              deny!("invalid_target",
+                    "resource must be an absolute URI without a fragment: #{value}",
+                    redirectable: true)
+            end
+          rescue URI::InvalidURIError
+            deny!("invalid_target", "resource is not a URI: #{value}", redirectable: true)
+          end
+        end
+    end
+  end
+end

data/app/policies/masks/server/policy.rb

@@ -0,0 +1,64 @@
+module Masks
+  module Server
+    class Policy
+      class Denied < StandardError
+        attr_reader :error, :description, :status, :redirectable
+
+        def initialize(error, description, status: :bad_request, redirectable: false)
+          super("#{error}: #{description}")
+
+          @error = error.to_s
+          @description = description.to_s
+          @status = status
+          @redirectable = redirectable
+        end
+
+        def to_h
+          { "error" => error, "error_description" => description }
+        end
+      end
+
+      class << self
+        def checks(*names)
+          declared.concat(names.map(&:to_sym))
+          self
+        end
+
+        def uses(*policies)
+          used.concat(policies)
+          self
+        end
+
+        def declared
+          @declared ||= inherited_from(:declared)
+        end
+
+        def used
+          @used ||= inherited_from(:used)
+        end
+
+        private
+
+          def inherited_from(name)
+            superclass.respond_to?(name) ? superclass.public_send(name).dup : []
+          end
+      end
+
+      attr_reader :subject
+
+      def initialize(subject)
+        @subject = subject
+      end
+
+      def call
+        self.class.used.uniq.each { |policy| policy.new(subject).call }
+        self.class.declared.uniq.each { |name| send(name) }
+        self
+      end
+
+      def deny!(error, description, status: :bad_request, redirectable: false)
+        raise Denied.new(error, description, status: status, redirectable: redirectable)
+      end
+    end
+  end
+end

data/app/views/layouts/masks/server/application.html.erb

@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<html lang="<%= Masks::Server::Locales.tag %>">
+  <head>
+    <title><%= content_for(:title) || Masks::Server::Current.tenant&.name %></title>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width,initial-scale=1">
+    <meta name="masks-root" content="<%= request.script_name %>">
+    <meta name="color-scheme" content="light dark">
+    <link rel="icon" href="/masks-public/favicon.svg" type="image/svg+xml">
+    <link rel="apple-touch-icon" href="/masks-public/icon.png">
+    <%= csrf_meta_tags %>
+    <%= csp_meta_tag %>
+    <%= vite_client_tag %>
+    <%= vite_stylesheet_tag "app" %>
+    <%= tenant_accent(Masks::Server::Current.tenant) %>
+    <% Masks::Server::Themes.for(tenant: Masks::Server::Current.tenant, client: themed_client).each do |theme| %>
+      <%= tag.link rel: "stylesheet", href: theme_path(theme.digest) %>
+    <% end %>
+    <%= yield :scripts %>
+  </head>
+
+  <% surface = content_for(:surface).to_s.strip.presence || "challenge" %>
+
+  <body class="auth-page">
+    <main class="auth-col surface-<%= surface %>">
+      <% if surface == "challenge" && Masks::Server::Current.tenant&.name.present? %>
+        <div class="auth-id">
+          <%= tenant_mark(Masks::Server::Current.tenant) %>
+          <span class="auth-tenant"><%= Masks::Server::Current.tenant.name %></span>
+        </div>
+      <% end %>
+
+      <div class="flow">
+        <%= render "masks/server/application/flashes" unless surface == "place" %>
+
+        <%= yield %>
+      </div>
+    </main>
+  </body>
+</html>