masks-server 0.7.0

data/app/controllers/masks/server/saml_controller.rb

@@ -0,0 +1,195 @@
+module Masks
+  module Server
+    class SamlController < ApplicationController
+      include SamlFarewells
+
+      skip_forgery_protection only: %i[sso slo]
+
+      rate_limit to: 60, within: 1.minute, only: %i[sso initiate slo],
+                 by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
+                 with: -> { refuse("too many sign-in requests from this address", status: :too_many_requests) }
+
+      rescue_from SamlIdentity::Refused do |refusal|
+        refuse(refusal.message)
+      end
+
+      def metadata
+        expires_in 5.minutes, public: true
+        render xml: SamlIdentity::Metadata.new(issuer).to_xml
+      end
+
+      def sso
+        asked = SamlIdentity::Request.read!(request, issuer: issuer)
+
+        saml = { "request_id" => asked.id, "relay_state" => asked.relay_state, "name_id_format" => asked.name_id_format }
+        prompt = [ ("login" if asked.force_authn), ("none" if asked.passive) ]
+
+        answer(track_request!(authorization_for(asked.client, asked.acs_url, saml, prompt: prompt)))
+      end
+
+      def slo
+        carried = request.post? ? request.request_parameters : request.query_parameters
+
+        carried.key?("SAMLResponse") ? farewell_answered : logout_requested
+      end
+
+      def initiate
+        client = Client.authenticating(params[:client_id], protocol: SamlIdentity::PROTOCOL)
+
+        raise SamlIdentity::Refused, "no application is registered here with that id" if client.nil?
+        raise SamlIdentity::Refused, "#{client.name} is only signed into from its own sign-in page" unless client.saml_idp_initiated?
+
+        saml = {
+          "relay_state" => params[:RelayState].presence,
+          "name_id_format" => client.saml_name_id_format.presence || SamlIdentity::PERSISTENT,
+          "nonce" => SecureRandom.uuid
+        }
+
+        answer(track_request!(authorization_for(client, client.redirect_uris.first, saml)))
+      end
+
+      def resume
+        pending = pending_request(params[:rid])
+
+        raise SamlIdentity::Refused, "that sign-in has expired or was already answered" unless pending&.saml?
+
+        answer(pending)
+      end
+
+      def refused
+        pending = refused_request(params[:rid])
+
+        raise SamlIdentity::Refused, "that sign-in has expired" unless pending&.saml?
+
+        post(pending, failure(pending, SamlIdentity::RESPONDER, SamlIdentity::REQUEST_DENIED, "the person signing in was refused"))
+      end
+
+      private
+
+        def logout_requested
+          asked = SamlIdentity::LogoutRequest.read!(request, issuer: issuer)
+
+          found = SamlParticipation.where(client: asked.client, name_id: asked.name_id)
+          found = found.where(session_index: asked.session_indexes) if asked.session_indexes.any?
+          found = found.includes(:session).to_a
+
+          finish = { "client_id" => asked.client.client_id, "in_response_to" => asked.id, "relay_state" => asked.relay_state,
+                     "known" => found.any? }
+
+          found.each(&:claimed?)
+
+          ending = found.map(&:session).uniq.select { |held| held.revoked_at.nil? }
+          browser = ending.find { |held| held.id == current_session&.id }
+          departing = browser ? SamlParticipation.claim!(browser.saml_participations) : []
+
+          ending.each { |held| held == browser ? sign_out : end_elsewhere(held, asked.client) }
+
+          farewell(departing, finish: finish)
+        end
+
+        def farewell_answered
+          reply = SamlIdentity::LogoutReply.read!(request, issuer: issuer)
+          farewells = SamlIdentity::Farewells.resume(reply.in_response_to, client: reply.client)
+
+          raise SamlIdentity::Refused, "that LogoutResponse answers nothing masks is waiting on" if farewells.nil?
+
+          proceed(farewells)
+        end
+
+        def end_elsewhere(session, client)
+          session.revoke!
+
+          Event.record!(Event::SESSION_ENDED, actor: session.actor, by: nil, device: session.device, client: client)
+        end
+
+        def authorization_for(client, acs_url, saml, prompt: [])
+          Authorization.new(
+            client_id: client.client_id,
+            redirect_uri: acs_url,
+            response_type: SamlIdentity::PROTOCOL,
+            scope: Scopes.join(SamlIdentity::SCOPES),
+            prompt: Scopes.join(prompt.compact),
+            saml: saml.compact
+          )
+        end
+
+        def answer(pending)
+          return refuse("that sign-in has already been answered") if pending.consumed?
+
+          login = advance(pending)
+
+          return post(pending, denied(pending, login.refusal.description)) if login.refused?
+          return post(pending, denied(pending, "the person has to be asked", second: SamlIdentity::NO_PASSIVE)) if login.prompted? && pending.silent?
+          return redirect_to(login.redirect_to, allow_other_host: true) if login.redirect_to.present?
+          return prompt(login) unless login.settled?
+
+          complete(pending, login)
+        end
+
+        def complete(pending, login)
+          claimed = PendingRequest.claim(rid_for(pending))
+
+          return refuse("that sign-in has already been answered") if claimed.nil?
+
+          settle!(login)
+
+          saml = pending.held("saml")
+          scopes = pending.scopes_for(current_actor)
+
+          assertion = response_for(pending)
+          encoded = assertion.success(
+            actor: current_actor, session: current_session, name_id_format: saml["name_id_format"], scopes: scopes,
+            authenticated_at: login.authenticated_at || current_session&.authenticated_at,
+            amr: login.amr.presence || current_session&.amr
+          )
+
+          Event.record!(Event::SAML_ASSERTED, actor: current_actor, client: pending.client, scopes: scopes,
+                                              initiated: saml["request_id"] ? "service provider" : "masks")
+
+          participated!(pending.client, assertion, saml["name_id_format"])
+
+          post(pending, encoded)
+        end
+
+        def participated!(client, assertion, name_id_format)
+          return if current_session.nil?
+
+          SamlParticipation.record!(session: current_session, client: client, name_id: assertion.name_id, name_id_format: name_id_format)
+        end
+
+        def denied(pending, description, second: SamlIdentity::REQUEST_DENIED)
+          PendingRequest.claim(rid_for(pending))
+
+          failure(pending, SamlIdentity::RESPONDER, second, description)
+        end
+
+        def failure(pending, status, second, message)
+          response_for(pending).failure(status, second, message)
+        end
+
+        def response_for(pending)
+          SamlIdentity::Response.new(
+            issuer: issuer, client: pending.client, destination: pending.redirect_uri,
+            in_response_to: pending.held("saml")["request_id"]
+          )
+        end
+
+        def refused_request(rid)
+          return nil if rid.blank? || !tracked(REQUESTS).value?(rid)
+
+          PendingRequest.spent(rid)&.then { |held| held if held.consumed? }
+        end
+
+        def post(pending, encoded)
+          post_saml(pending.client, pending.redirect_uri, "SAMLResponse", encoded, relay_state: pending.held("saml")["relay_state"])
+        end
+
+        def refuse(description, status: :bad_request)
+          @error_code = "invalid_saml_request"
+          @error_description = description
+
+          render "masks/server/authorize/error", status: status
+        end
+    end
+  end
+end

data/app/controllers/masks/server/scim/groups_controller.rb

@@ -0,0 +1,157 @@
+module Masks
+  module Server
+    module Scim
+      class GroupsController < ApplicationController
+        include ScimEndpoint
+
+        before_action :organization!, except: %i[index show]
+
+        def index
+          groups = Scim::Group.filter(held ? Scim::Group.all(held, holders: (held.memberships.accepted if members?)) : [], params[:filter])
+          start, count = scim_page
+
+          scim(listed(groups.drop(start - 1).first(count).map { |group| represent(group) }, total: groups.size, start: start))
+        end
+
+        def show
+          scim(represent(found))
+        end
+
+        def create
+          role = document["displayName"].to_s.strip.downcase
+
+          raise Scim::Error.new(:bad_request, "a group is named by its displayName", scim_type: "invalidValue") if role.empty?
+          raise Scim::Error.new(:conflict, "#{held.name} already has the role #{role}", scim_type: "uniqueness") if held.role?(role)
+
+          group = Scim::Group.new(held, role)
+
+          Organization.transaction do
+            roles!(held.roles + [ role ])
+            replace!(group, group.member_ids(document["members"] || []))
+          end
+
+          response.headers["Location"] = "#{scim_base}/Groups/#{group.id}"
+          scim(represent(group), status: :created)
+        end
+
+        def replace
+          group = found
+          group.rename!(document["displayName"]) if document.key?("displayName")
+
+          Organization.transaction { replace!(group, group.member_ids(document["members"] || [])) }
+
+          scim(represent(group))
+        end
+
+        def update
+          group = found
+          patch_document!
+
+          changes = group.changes(document["Operations"])
+
+          Organization.transaction do
+            replace!(group, changes[:replace]) if changes[:replace]
+            eligible!(changes[:add]).each { |membership| assign!(membership, group.role) }
+            changes[:remove].each { |uuid| leave!(group, uuid) }
+          end
+
+          scim(represent(group))
+        end
+
+        def destroy
+          group = found
+
+          raise Scim::Error.new(:bad_request, "#{group.role} is built in to every organization", scim_type: "mutability") if group.built_in?
+
+          roles!(held.roles - [ group.role ])
+
+          head :no_content
+        end
+
+        private
+
+          def held
+            directory.organization
+          end
+
+          def organization!
+            return if held && !held.archived?
+
+            raise Scim::Error.new(:forbidden, "groups are an organization's roles, so only a token for one live organization changes them")
+          end
+
+          def found
+            (held && Scim::Group.find(held, params[:id])) || raise(Scim::Error.new(:not_found, "no group has that id"))
+          end
+
+          def members?
+            !params[:excludedAttributes].to_s.split(",").map(&:strip).include?("members")
+          end
+
+          def represent(group)
+            group.to_h(base: scim_base, members: members?)
+          end
+
+          def roles!(roles)
+            held.roles = roles
+
+            unless held.save
+              raise Scim::Error.new(:conflict, held.errors.full_messages.to_sentence, scim_type: "mutability") if held.errors.of_kind?(:base, :held)
+              raise Scim::Error.new(:bad_request, held.errors.full_messages.to_sentence, scim_type: "invalidValue")
+            end
+
+            Event.record!(Event::ORGANIZATION_UPDATED, by: nil, organization: held, changed: [ "roles" ], via: "scim")
+          end
+
+          def replace!(group, uuids)
+            wanted = uuids.to_set
+
+            unless group.role == Organization::MEMBER
+              holders = group.memberships.reject { |membership| wanted.include?(membership.actor.uuid) }
+              owned = directory.owned(holders.map(&:actor_id))
+
+              holders.each { |membership| assign!(membership, Organization::MEMBER) if owned.include?(membership.actor_id) }
+            end
+
+            eligible!(wanted).each { |membership| assign!(membership, group.role) }
+          end
+
+          def leave!(group, uuid)
+            return if group.role == Organization::MEMBER
+
+            membership = group.memberships.find_by(actors: { uuid: uuid })
+
+            return if membership.nil?
+
+            unless directory.owned([ membership.actor_id ]).any?
+              raise Scim::Error.new(:forbidden, "#{held.name}'s directory did not create #{membership.actor.identifier}, " \
+                                                "so it does not change their role", scim_type: "mutability")
+            end
+
+            assign!(membership, Organization::MEMBER)
+          end
+
+          def eligible!(uuids)
+            uuids = uuids.to_a.uniq
+            actors = Actor.where(uuid: uuids.grep(Subjects::UUID)).index_by(&:uuid)
+            memberships = held.memberships.accepted.where(actor_id: actors.values.map(&:id)).index_by(&:actor_id)
+            owned = directory.owned(memberships.keys)
+
+            uuids.map do |uuid|
+              membership = actors[uuid] && memberships[actors[uuid].id]
+
+              next membership if membership && owned.include?(membership.actor_id)
+
+              raise Scim::Error.new(:bad_request, "a group takes only people #{held.name}'s directory provisioned", scim_type: "invalidValue")
+            end
+          end
+
+          def assign!(membership, role)
+            Members.assign!(membership, role: role, by: nil, via: "scim")
+          rescue Members::Refused => e
+            raise Scim::Error.new(:conflict, e.message, scim_type: "mutability")
+          end
+      end
+    end
+  end
+end

data/app/controllers/masks/server/scim/metadata_controller.rb

@@ -0,0 +1,123 @@
+module Masks
+  module Server
+    module Scim
+      class MetadataController < ApplicationController
+        include ScimEndpoint
+
+        def service_provider_config
+          scim({
+            "schemas" => [ Scim::SERVICE_PROVIDER_CONFIG ],
+            "documentationUri" => "#{::Rails.configuration.masks.docs_url}/concepts/provisioning/",
+            "patch" => { "supported" => true },
+            "bulk" => { "supported" => false, "maxOperations" => 0, "maxPayloadSize" => 0 },
+            "filter" => { "supported" => true, "maxResults" => Scim::MAX_RESULTS },
+            "changePassword" => { "supported" => true },
+            "sort" => { "supported" => false },
+            "etag" => { "supported" => true },
+            "authenticationSchemes" => [
+              {
+                "type" => "oauthbearertoken",
+                "name" => "Bearer token",
+                "description" => "A provisioning token a manager issued, or an access token carrying #{Scopes::SCIM}",
+                "primary" => true
+              }
+            ],
+            "meta" => { "resourceType" => "ServiceProviderConfig", "location" => "#{scim_base}/ServiceProviderConfig" }
+          })
+        end
+
+        def resource_types
+          scim(listed([ user_type, group_type ]))
+        end
+
+        def resource_type
+          found = { "User" => user_type, "Group" => group_type }[params[:id]]
+
+          raise Scim::Error.new(:not_found, "only User and Group are provisioned here") if found.nil?
+
+          scim(found)
+        end
+
+        def schemas
+          scim(listed([ user_schema, group_schema ]))
+        end
+
+        def schema
+          found = { Scim::USER => user_schema, Scim::GROUP => group_schema }[params[:id]]
+
+          raise Scim::Error.new(:not_found, "that schema is not one this server speaks") if found.nil?
+
+          scim(found)
+        end
+
+        private
+
+          def user_type
+            {
+              "schemas" => [ Scim::RESOURCE_TYPE ], "id" => "User", "name" => "User", "endpoint" => "/Users",
+              "schema" => Scim::USER,
+              "meta" => { "resourceType" => "ResourceType", "location" => "#{scim_base}/ResourceTypes/User" }
+            }
+          end
+
+          def group_type
+            {
+              "schemas" => [ Scim::RESOURCE_TYPE ], "id" => "Group", "name" => "Group", "endpoint" => "/Groups",
+              "description" => "One role in the organization the token provisions for",
+              "schema" => Scim::GROUP,
+              "meta" => { "resourceType" => "ResourceType", "location" => "#{scim_base}/ResourceTypes/Group" }
+            }
+          end
+
+          def group_schema
+            {
+              "schemas" => [ Scim::SCHEMA ], "id" => Scim::GROUP, "name" => "Group",
+              "attributes" => [
+                attribute("displayName", required: true, uniqueness: "server", mutability: "immutable"),
+                { "name" => "members", "type" => "complex", "multiValued" => true, "required" => false,
+                  "mutability" => "readWrite", "returned" => "default",
+                  "subAttributes" => [
+                    attribute("value", mutability: "immutable"),
+                    attribute("display", mutability: "readOnly"),
+                    { "name" => "$ref", "type" => "reference", "referenceTypes" => [ "User" ], "mutability" => "immutable" },
+                    attribute("type", mutability: "immutable")
+                  ] }
+              ],
+              "meta" => { "resourceType" => "Schema", "location" => "#{scim_base}/Schemas/#{Scim::GROUP}" }
+            }
+          end
+
+          def user_schema
+            {
+              "schemas" => [ Scim::SCHEMA ], "id" => Scim::USER, "name" => "User",
+              "attributes" => [
+                attribute("userName", required: true, uniqueness: "server"),
+                attribute("externalId", uniqueness: "server", case_exact: true),
+                attribute("displayName"),
+                { "name" => "name", "type" => "complex", "multiValued" => false, "required" => false,
+                  "subAttributes" => %w[formatted givenName familyName middleName].map { |part| attribute(part) } },
+                attribute("profileUrl"),
+                attribute("locale"),
+                attribute("timezone"),
+                attribute("password", mutability: "writeOnly", returned: "never"),
+                { "name" => "active", "type" => "boolean", "multiValued" => false, "required" => false,
+                  "mutability" => "readWrite", "returned" => "default" },
+                multi("emails"), multi("phoneNumbers"), multi("photos")
+              ],
+              "meta" => { "resourceType" => "Schema", "location" => "#{scim_base}/Schemas/#{Scim::USER}" }
+            }
+          end
+
+          def attribute(name, required: false, uniqueness: "none", case_exact: false, mutability: "readWrite", returned: "default")
+            { "name" => name, "type" => "string", "multiValued" => false, "required" => required, "caseExact" => case_exact,
+              "mutability" => mutability, "returned" => returned, "uniqueness" => uniqueness }
+          end
+
+          def multi(name)
+            { "name" => name, "type" => "complex", "multiValued" => true, "required" => false,
+              "subAttributes" => [ attribute("value"), attribute("type"), { "name" => "primary", "type" => "boolean" } ] }
+          end
+      end
+    end
+  end
+end

data/app/controllers/masks/server/scim/users_controller.rb

@@ -0,0 +1,128 @@
+module Masks
+  module Server
+    module Scim
+      class UsersController < ApplicationController
+        include ScimEndpoint
+
+        def index
+          relation = Scim::Filter.apply(directory.people, params[:filter], columns: directory.columns)
+          start, count = scim_page
+          actors = relation.order(:created_at, :id).offset(start - 1).limit(count).to_a
+
+          scim(listed(actors.map { |actor| represent(directory.user(actor)) }, total: relation.count(:all), start: start))
+        end
+
+        def show
+          user = directory.user(found)
+
+          response.headers["ETag"] = user.version
+          scim(represent(user))
+        end
+
+        def create
+          user = settle!(directory.user(Actor.new).replace(document), Event::ACTOR_PROVISIONED)
+
+          response.headers["Location"] = "#{scim_base}/Users/#{user.actor.uuid}"
+          scim(represent(user), status: :created)
+        end
+
+        def replace
+          user = changeable
+
+          scim(represent(settle!(user.replace(document), Event::ACTOR_UPDATED)))
+        end
+
+        def update
+          user = changeable
+          patch_document!
+
+          scim(represent(settle!(user.patch(document["Operations"]), Event::ACTOR_UPDATED)))
+        end
+
+        def destroy
+          directory.remove!(found)
+
+          head :no_content
+        end
+
+        private
+
+          def found
+            directory.people.find_by(uuid: params[:id].to_s.match?(Subjects::UUID) ? params[:id] : nil) ||
+              raise(Scim::Error.new(:not_found, "no user has that id"))
+          end
+
+          def changeable
+            user = directory.user(found)
+
+            matched!(user)
+            directory.owned!(user.actor)
+
+            user
+          end
+
+          def represent(user)
+            user.to_h(base: scim_base)
+          end
+
+          def matched!(user)
+            wanted = request.headers["If-Match"].presence
+
+            return if wanted.nil? || wanted == "*" || wanted == user.version
+
+            raise Scim::Error.new(:precondition_failed, "that user has changed since it was read")
+          end
+
+          def settle!(user, action)
+            actor = user.actor
+
+            directory.proven!(actor) if actor.email_changed?
+            guarded!(actor)
+            directory.keep_a_manager!(actor) if user.suspending && !actor.suspended?
+
+            actor.email_verified_at = actor.email.present? ? Time.current : nil if actor.email_changed?
+
+            Actor.transaction do
+              directory.save!(actor, user.external_id)
+              suspend_or_restore!(actor, user.suspending)
+            end
+
+            Event.record!(action, actor: actor, by: nil, via: "scim", external_id: user.external_id)
+
+            user
+          rescue ActiveRecord::RecordInvalid => e
+            raise taken if e.record.errors.details.values.flatten.any? { |detail| detail[:error] == :taken }
+
+            raise Scim::Error.new(:bad_request, e.record.errors.full_messages.join("; "), scim_type: "invalidValue")
+          rescue ActiveRecord::RecordNotUnique
+            raise taken
+          end
+
+          def taken
+            Scim::Error.new(:conflict, "another user already holds that userName, email or externalId", scim_type: "uniqueness")
+          end
+
+          def suspend_or_restore!(actor, suspending)
+            return if suspending.nil?
+
+            if suspending && !actor.suspended?
+              actor.suspend!(reason: Actor::SCIM)
+              Event.record!(Event::ACTOR_SUSPENDED, actor: actor, by: nil, via: "scim")
+            elsif !suspending && actor.suspended?
+              actor.restore!
+              Event.record!(Event::ACTOR_RESTORED, actor: actor, by: nil, via: "scim")
+            end
+          end
+
+          def guarded!(actor)
+            return if actor.new_record? || Scopes.reserved(actor.scope_list).empty?
+
+            if actor.password_digest_changed? || actor.email_changed?
+              raise Scim::Error.new(:forbidden, "#{actor.identifier} holds a masks: scope, so their password and email are not provisioned",
+                                    scim_type: "mutability")
+            end
+          end
+      end
+    end
+  end
+end

data/app/controllers/masks/server/sessions_controller.rb

@@ -0,0 +1,60 @@
+module Masks
+  module Server
+    class SessionsController < ApplicationController
+      include SamlFarewells
+
+      skip_forgery_protection only: :destroy, if: -> { request.get? }
+
+      def destroy
+        logout = build_logout
+
+        return confirm(logout) if asking?(logout)
+
+        end_session(logout)
+      rescue Logout::Refused => refusal
+        render_refusal(refusal)
+      end
+
+      private
+
+        def build_logout
+          Logout.new(
+            issuer: issuer,
+            id_token_hint: params[:id_token_hint],
+            client_id: params[:client_id],
+            post_logout_redirect_uri: params[:post_logout_redirect_uri],
+            state: params[:state]
+          )
+        end
+
+        def asking?(logout)
+          return false unless request.get? || request.head?
+          return false if logout.names?(current_actor)
+
+          current_session.present?
+        end
+
+        def confirm(logout)
+          @logout = logout
+          @client = logout.client
+
+          render :confirm
+        end
+
+        def end_session(logout)
+          departing = current_session ? SamlParticipation.claim!(current_session.saml_participations) : []
+
+          sign_out
+
+          farewell(departing, finish: { "redirect" => logout.redirect_to || login_path })
+        end
+
+        def render_refusal(refusal)
+          @error_code = refusal.code
+          @error_description = refusal.message
+
+          render "masks/server/authorize/error", status: :bad_request
+        end
+    end
+  end
+end