masks-server 0.7.0

data/app/controllers/masks/server/organization_members_controller.rb

@@ -0,0 +1,118 @@
+module Masks
+  module Server
+    class OrganizationMembersController < ApplicationController
+      class NotOwner < StandardError; end
+
+      rescue_from NotOwner do
+        back(alert: t("organization_members.owners_only", organization: @organization.name))
+      end
+
+      rate_limit to: 30, within: 1.minute, only: %i[create resend],
+                 by: -> { [ current_tenant.id, current_actor&.id || request.remote_ip ].join(":") },
+                 with: -> { back(alert: t("organization_members.slow_down")) }
+
+      before_action :require_actor
+      before_action :require_membership
+
+      def create
+        own!
+
+        email = params[:email].to_s.strip
+
+        Members.add!(organization: @organization, role: params[:role].to_s, by: current_actor, email: email,
+                     journey: Journey.manage(current_actor))
+
+        back(notice: t("organization_members.added", identifier: email, organization: @organization.name))
+      rescue Members::Refused => e
+        back(alert: e.message)
+      end
+
+      def update
+        own!
+
+        membership = member!
+
+        Members.assign!(membership, role: params[:role].to_s, by: current_actor)
+
+        back(notice: t("organization_members.assigned", identifier: labelled(membership), role: membership.role))
+      rescue Members::Refused => e
+        back(alert: e.message)
+      end
+
+      def resend
+        own!
+
+        membership = member!
+
+        Members.resend!(membership, by: current_actor, journey: Journey.manage(current_actor))
+
+        back(notice: t("organization_members.resent", identifier: labelled(membership),
+                                                      age: helpers.distance_of_time_in_words(Membership.lifetime)))
+      rescue Members::Refused => e
+        back(alert: e.message)
+      end
+
+      def accept
+        @own.accept!
+
+        back(notice: t("organization_members.accepted", organization: @organization.name, role: @own.role))
+      rescue Membership::Expired
+        back(alert: t("organization_members.expired", organization: @organization.name))
+      rescue Membership::Unconfirmed
+        back(alert: t(@own.addressed_to?(current_actor) ? "organization_members.confirm_first" : "organization_members.elsewhere",
+                      address: @own.invited_as, organization: @organization.name))
+      end
+
+      def destroy
+        membership = member!
+        leaving = membership.actor_id == current_actor.id
+
+        own! unless leaving
+
+        Members.remove!(membership, by: current_actor)
+
+        if leaving
+          back(notice: t(membership.pending? ? "organization_members.declined" : "organization_members.left",
+                         organization: @organization.name))
+        else
+          back(notice: t("organization_members.removed", identifier: labelled(membership), organization: @organization.name))
+        end
+      rescue Members::Refused => e
+        back(alert: e.message)
+      end
+
+      private
+
+        def require_actor
+          redirect_to login_path unless current_actor
+        end
+
+        def require_membership
+          @organization = Organization.active.find_by(key: params[:key])
+          @own = @organization&.memberships&.find_by(actor: current_actor)
+
+          back(alert: t("organization_members.unknown")) if @own.nil?
+        end
+
+        def own!
+          raise NotOwner unless @own.owner?
+        end
+
+        def member!
+          @organization.memberships.includes(:actor).find_by(id: params[:id].to_s) ||
+            raise(Members::Refused, t("organization_members.not_a_member"))
+        end
+
+        def labelled(membership)
+          Members.label(membership) || t("organization_members.invitee")
+        end
+
+        def back(**flash)
+          return redirect_to(root_path(anchor: "organizations"), **flash) if @organization.nil?
+
+          redirect_to root_path(anchor: "organization-#{@organization.key}"),
+                      flash: flash.merge(organization: @organization.key)
+        end
+    end
+  end
+end

data/app/controllers/masks/server/passkeys_controller.rb

@@ -0,0 +1,80 @@
+module Masks
+  module Server
+    class PasskeysController < ApplicationController
+      HELD = "passkey_registration".freeze
+
+      before_action :require_actor
+      before_action :require_fresh_sign_in, except: :update
+
+      def create
+        held = session.delete(HELD)
+
+        return refuse(t("passkeys.expired")) if held.blank?
+        return refuse(t("passkeys.crowded")) if Passkey.crowded?(current_actor)
+
+        credential = RelyingParty.for.verify_registration(attestation, held)
+
+        Passkey.register!(actor: current_actor, credential: credential, name: params[:name])
+
+        redirect_to root_path, notice: t("passkeys.added")
+      rescue WebAuthn::Error, ActiveRecord::RecordInvalid, JSON::ParserError
+        refuse(t("passkeys.unusable"))
+      end
+
+      def challenge
+        held = RelyingParty.for.registration_options(current_actor)
+
+        session[HELD] = held.challenge
+
+        render json: held.as_json
+      end
+
+      def update
+        return refuse(t("passkeys.unknown")) if passkey.nil?
+        return refuse(t("passkeys.unnamed", limit: Passkey::NAME_LIMIT)) unless passkey.update(name: params[:name])
+
+        Event.record!(Event::PASSKEY_RENAMED, actor: current_actor, passkey: passkey.name)
+
+        redirect_to root_path(anchor: "passkeys"), notice: t("passkeys.renamed")
+      end
+
+      def destroy
+        return refuse(t("passkeys.unknown")) if passkey.nil?
+        return refuse(t("passkeys.last_way_in")) if current_actor.last_way_in?(passkey)
+
+        passkey.destroy!
+
+        Event.record!(Event::PASSKEY_REMOVED, actor: current_actor, passkey: passkey.name)
+
+        redirect_to root_path, notice: t("passkeys.removed")
+      end
+
+      private
+
+        def passkey
+          @passkey ||= Passkey.find_by(id: params[:id], actor_id: current_actor.id)
+        end
+
+        def require_actor
+          redirect_to login_path unless current_actor
+        end
+
+        def require_fresh_sign_in
+          return if current_session.fresh?
+          return reauthenticated!("passkeys", t("passkeys.again")) unless request.format.json?
+
+          sign_out
+          render json: { "redirectTo" => login_path(return_to: root_path(anchor: "passkeys")) }, status: :unauthorized
+        end
+
+
+        def attestation
+          JSON.parse(params.require(:credential))
+        end
+
+        def refuse(message)
+          redirect_to root_path, alert: message
+        end
+    end
+  end
+end

data/app/controllers/masks/server/passwords_controller.rb

@@ -0,0 +1,67 @@
+module Masks
+  module Server
+    class PasswordsController < ApplicationController
+      rate_limit to: ::Rails.configuration.masks.account_attempt_limit,
+                 within: 3.minutes,
+                 by: -> { [ current_tenant.id, current_actor&.id ].join(":") },
+                 with: -> { refuse(t("passwords.too_many_attempts")) }
+
+      before_action :require_actor
+
+      def update
+        return set_password unless current_actor.password?
+
+        refusal = Passwords.refusal(replacement, policy)
+
+        return refuse(t("passwords.#{refusal.underscore}", minimum: policy.password_minimum), field: :password) if refusal
+
+        changed = current_actor.change_password!(current, replacement, keeping: current_session)
+
+        return refuse(t("passwords.wrong_current"), field: :current_password) unless changed
+
+        Event.record!(Event::PASSWORD_CHANGED, actor: current_actor)
+
+        redirect_to root_path, notice: t("passwords.changed")
+      end
+
+      private
+
+        def set_password
+          return unless reauthenticated!("password", t("passwords.again"))
+
+          refusal = Passwords.refusal(replacement, policy)
+
+          return refuse(t("passwords.#{refusal.underscore}", minimum: policy.password_minimum), field: :password) if refusal
+
+          current_actor.reset_password!(replacement, keeping: current_session)
+
+          Event.record!(Event::PASSWORD_CHANGED, actor: current_actor)
+
+          redirect_to root_path, notice: t("passwords.set")
+        end
+
+        def require_actor
+          redirect_to login_path unless current_actor
+        end
+
+        def current
+          params.require(:current_password).to_s
+        end
+
+        def replacement
+          params.require(:password).to_s
+        end
+
+        def policy
+          @policy ||= SignInPolicy.for(tenant: current_tenant)
+        end
+
+        def refuse(message, field: nil)
+          return redirect_to root_path, alert: message if field.nil?
+
+          flash[:password_field] = { field.to_s => message }
+          redirect_to root_path(anchor: "password")
+        end
+    end
+  end
+end

data/app/controllers/masks/server/profiles_controller.rb

@@ -0,0 +1,34 @@
+module Masks
+  module Server
+    class ProfilesController < ApplicationController
+      before_action :require_actor
+
+      def update
+        return refuse(t("profiles.directed")) if current_actor.directed?
+
+        current_actor.assign_attributes(profile)
+        changed = current_actor.changed
+
+        return refuse(t("profiles.invalid", errors: current_actor.errors.full_messages.to_sentence)) unless current_actor.save
+
+        Event.record!(Event::ACTOR_UPDATED, actor: current_actor, changed: changed) if changed.any?
+
+        redirect_to root_path(anchor: "profile"), notice: t("profiles.updated")
+      end
+
+      private
+
+        def profile
+          params.permit(:name, :nickname).to_h.transform_values { |value| value.strip.presence }
+        end
+
+        def require_actor
+          redirect_to login_path unless current_actor
+        end
+
+        def refuse(message)
+          redirect_to root_path(anchor: "profile"), alert: message
+        end
+    end
+  end
+end

data/app/controllers/masks/server/provider_metadata_controller.rb

@@ -0,0 +1,13 @@
+module Masks
+  module Server
+    class ProviderMetadataController < ApplicationController
+      def show
+        provider = Provider.active.find_by(key: params[:key].to_s, protocol: Provider::SAML)
+
+        return head :not_found if provider.nil?
+
+        render xml: provider.federation.metadata(callback: provider.callback_url)
+      end
+    end
+  end
+end

data/app/controllers/masks/server/pushed_authorizations_controller.rb

@@ -0,0 +1,69 @@
+module Masks
+  module Server
+    class PushedAuthorizationsController < ApplicationController
+      include TokenPresented
+
+      rate_limit to: 60, within: 1.minute,
+                 by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
+                 with: -> { slow_down }
+
+      def create
+        client = authenticate_client!
+        authorization = unpacked(client, Authorization.from_request(request))
+
+        check!(client, authorization)
+
+        pushed = PushedRequest.push!(authorization)
+
+        no_store!
+
+        render json: {
+          "request_uri" => pushed.request_uri,
+          "expires_in" => pushed.expires_in
+        }, status: :created
+      end
+
+      private
+
+        def unpacked(client, authorization)
+          refuse!("a pushed request may not carry a request_uri of its own") if authorization.request_uri?
+
+          return authorization unless authorization.request_object?
+
+          unless authorization.client_id.blank? || authorization.client_id == client.client_id
+            refuse!("client_id does not match the authenticated client")
+          end
+
+          RequestObject.new(authorization.request_object, client: client, client_id: client.client_id, issuer: issuer).authorization
+        rescue RequestObject::Refused => e
+          raise Policy::Denied.new("invalid_request_object", e.message)
+        end
+
+        def check!(client, authorization)
+          refuse!("this client has to sign its authorization requests") if client.require_signed_request_object? && !authorization.signed?
+
+          refuse!("client_id is required") if authorization.client_id.blank?
+
+          unless authorization.client_id == client.client_id
+            refuse!("client_id does not match the authenticated client")
+          end
+
+          refuse!("response_type must be code") unless authorization.response_type == "code"
+          refuse!("redirect_uri is required") if authorization.redirect_uri.blank?
+
+          unless client.redirect_uri?(authorization.redirect_uri)
+            refuse!("redirect_uri is not registered for this client")
+          end
+
+          authorization.validate!
+        end
+
+        def slow_down
+          render json: {
+            "error" => "slow_down",
+            "error_description" => "too many pushed requests from this address"
+          }, status: :too_many_requests
+        end
+    end
+  end
+end

data/app/controllers/masks/server/received_signals_controller.rb

@@ -0,0 +1,19 @@
+module Masks
+  module Server
+    class ReceivedSignalsController < ApplicationController
+      skip_forgery_protection
+
+      rate_limit to: 600, within: 1.minute, only: :create,
+                 by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
+                 with: -> { render json: { "err" => "invalid_request", "description" => "too many events from this address" }, status: :too_many_requests }
+
+      def create
+        ReceivedSignal.new(request.raw_post, issuer: issuer).receive!
+
+        head :accepted
+      rescue ReceivedSignal::Refused => e
+        render json: { "err" => e.code, "description" => e.message }, status: :bad_request
+      end
+    end
+  end
+end

data/app/controllers/masks/server/registrations_controller.rb

@@ -0,0 +1,137 @@
+module Masks
+  module Server
+    class RegistrationsController < ApplicationController
+      skip_forgery_protection
+
+      rate_limit to: ::Rails.configuration.masks.registration_limit, within: 10.minutes, only: :create,
+                 by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
+                 with: -> {
+                   render json: {
+                     "error" => "too_many_requests",
+                     "error_description" => "too many registrations from this address"
+                   }, status: :too_many_requests
+                 }
+
+      before_action :no_store!
+      before_action :require_registration_token, except: :create
+
+      def create
+        return redeem if bearer.present?
+        return refused unless current_tenant.registers?
+
+        client = Client.register!(body)
+
+        Event.record!(Event::CLIENT_REGISTERED, client: client, name: client.name, dynamic: true)
+
+        render json: issued(client), status: :created
+      rescue ActiveRecord::RecordInvalid => e
+        invalid_metadata(e.record.errors.full_messages.join("; "))
+      rescue Client::ScopesUnavailable => e
+        invalid_metadata(e.message)
+      end
+
+      def show
+        render json: @client.metadata.merge("registration_client_uri" => registration_uri(@client))
+      end
+
+      def update
+        @client.update!(described.merge(scope_updates))
+
+        Event.record!(Event::CLIENT_UPDATED, client: @client, name: @client.name, dynamic: true)
+
+        render json: @client.metadata.merge("registration_client_uri" => registration_uri(@client))
+      rescue ActiveRecord::RecordInvalid => e
+        invalid_metadata(e.record.errors.full_messages.join("; "))
+      rescue Client::ScopesUnavailable => e
+        invalid_metadata(e.message)
+      end
+
+      def destroy
+        @client.update!(archived_at: Time.current)
+
+        Event.record!(Event::CLIENT_ARCHIVED, client: @client, name: @client.name)
+
+        head :no_content
+      end
+
+      private
+
+        def redeem
+          token = InitialAccessToken.claim(bearer)
+
+          return unauthorized("that initial access token is not valid or has expired") if token&.client.nil?
+
+          render json: issued(token.issue!), status: :created
+        end
+
+        def bearer
+          request.authorization.to_s[/\ABearer (\S+)\z/, 1]
+        end
+
+        def body
+          @body ||= begin
+            parsed = JSON.parse(request.raw_post.presence || "{}")
+            parsed.is_a?(Hash) ? parsed.symbolize_keys : {}
+          rescue JSON::ParserError
+            {}
+          end
+        end
+
+        def described
+          held = Client.metadata_attributes(body)
+
+          @client.approved? ? held.except(*Client::APPROVED) : held
+        end
+
+        def scope_updates
+          return {} if body[:scope].blank? || @client.approved?
+
+          { allowed_scopes: Scopes.join(Client.bounded(body[:scope])) }
+        end
+
+        def refused
+          render json: {
+            "error" => "access_denied",
+            "error_description" => "dynamic registration is off here, and a manager adds every client"
+          }, status: :forbidden
+        end
+
+        def invalid_metadata(description)
+          render json: {
+            "error" => "invalid_client_metadata",
+            "error_description" => description
+          }, status: :bad_request
+        end
+
+        def issued(client)
+          client.metadata.merge(
+            "client_secret" => client.secret,
+            "client_secret_expires_at" => client.secret_expires_at&.to_i || 0,
+            "registration_access_token" => client.registration_token,
+            "registration_client_uri" => registration_uri(client)
+          ).compact
+        end
+
+        def registration_uri(client)
+          "#{issuer.url}/register/#{client.client_id}"
+        end
+
+        def require_registration_token
+          @client = Client.by_registration_token(bearer)
+
+          return if @client && @client.client_id == params[:client_id]
+
+          unauthorized("a registration access token is required")
+        end
+
+        def unauthorized(description)
+          response.headers["WWW-Authenticate"] = %(Bearer error="invalid_token")
+
+          render json: {
+            "error" => "invalid_token",
+            "error_description" => description
+          }, status: :unauthorized
+        end
+    end
+  end
+end

data/app/controllers/masks/server/revocations_controller.rb

@@ -0,0 +1,33 @@
+module Masks
+  module Server
+    class RevocationsController < ApplicationController
+      include TokenPresented
+
+      rate_limit to: 120, within: 1.minute,
+                 by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
+                 with: -> {
+                   render json: {
+                     "error" => "slow_down",
+                     "error_description" => "too many revocation requests from this address"
+                   }, status: :too_many_requests
+                 }
+
+      def create
+        client = authenticate_client!
+        token = presented_token
+
+        if token && token.client_id == client.id
+          revoked = token.revoke!
+
+          Event.record!(
+            Event::TOKEN_REVOKED,
+            actor: token.actor, by: nil, client: client,
+            kind: token.class.name.underscore, revoked: revoked
+          )
+        end
+
+        head :ok
+      end
+    end
+  end
+end