masks-server 0.7.0

data/app/controllers/masks/server/sign_in_approvals_controller.rb

@@ -0,0 +1,48 @@
+module Masks
+  module Server
+    class SignInApprovalsController < ApplicationController
+      HELD = "approving".freeze
+
+      before_action :require_trusted_device
+
+      rate_limit to: ::Rails.configuration.masks.account_attempt_limit,
+                 within: 3.minutes,
+                 only: :create,
+                 by: -> { [ current_tenant.id, current_actor&.id ].join(":") },
+                 with: -> { refuse(t("sign_in_approvals.too_many_attempts")) }
+
+      def create
+        approval = SignInApproval.matching(actor: current_actor, code: params[:code], from: current_device)
+
+        return refuse(t("sign_in_approvals.no_match")) if approval.nil?
+
+        session[HELD] = approval.id
+
+        redirect_to root_path(anchor: "approve")
+      end
+
+      def update
+        approval = SignInApproval.waiting.find_by(id: session.delete(HELD), actor_id: current_actor.id)
+        verdict = params[:answer] == "approve" ? "approved" : "denied"
+
+        return refuse(t("sign_in_approvals.expired")) unless approval&.answer!(verdict, by: current_device)
+
+        Event.record!("sign_in.#{verdict}", actor: current_actor, asking: approval.device&.label)
+
+        redirect_to root_path, notice: t("sign_in_approvals.#{verdict}")
+      end
+
+      private
+
+        def require_trusted_device
+          return redirect_to login_path unless current_actor
+
+          refuse(t("sign_in_approvals.untrusted")) unless DeviceFactor.satisfied?(device: current_device, actor: current_actor)
+        end
+
+        def refuse(message)
+          redirect_to root_path(anchor: "approve"), alert: message
+        end
+    end
+  end
+end

data/app/controllers/masks/server/signal_streams_controller.rb

@@ -0,0 +1,162 @@
+module Masks
+  module Server
+    class SignalStreamsController < ApplicationController
+      include RackOAuth2Endpoint
+      include ResourceToken
+
+      class Invalid < StandardError; end
+      class Missing < StandardError; end
+
+      skip_forgery_protection
+
+      rescue_from Invalid, ActiveRecord::RecordInvalid, ActionController::ParameterMissing do |error|
+        message = error.respond_to?(:record) ? error.record.errors.full_messages.to_sentence : error.message
+
+        render json: refusal(message), status: :bad_request
+      end
+
+      rescue_from Missing do
+        render json: refusal("no stream with that stream_id"), status: :not_found
+      end
+
+      def configuration
+        render json: issuer.signals_configuration
+      end
+
+      def show
+        receiving do |client|
+          stream = client_stream(client)
+
+          next render(json: [ stream&.configuration ].compact) if params[:stream_id].blank?
+
+          render json: stream!(stream).configuration
+        end
+      end
+
+      def create
+        receiving do |client|
+          next render(json: refusal("this receiver already has a stream"), status: :conflict) if client_stream(client)
+
+          stream = SignalStream.new(client: client, issuer: issuer.url, status: SignalStream::ENABLED)
+          configure!(stream, replace: true)
+          record!(Event::SIGNAL_STREAM_CREATED, stream)
+
+          render json: stream.configuration, status: :created
+        end
+      end
+
+      def update
+        receiving do |client|
+          stream = stream!(client_stream(client))
+          configure!(stream, replace: request.put?)
+          record!(Event::SIGNAL_STREAM_UPDATED, stream)
+
+          render json: stream.configuration
+        end
+      end
+
+      def destroy
+        receiving do |client|
+          stream = stream!(client_stream(client))
+          stream.destroy!
+          record!(Event::SIGNAL_STREAM_DELETED, stream)
+
+          head :no_content
+        end
+      end
+
+      def status
+        receiving do |client|
+          render json: stream!(client_stream(client)).state
+        end
+      end
+
+      def update_status
+        receiving do |client|
+          stream = stream!(client_stream(client))
+          status = body["status"].to_s
+
+          raise Invalid, "status must be one of #{SignalStream::STATUSES.join(', ')}" unless SignalStream::STATUSES.include?(status)
+
+          stream.update!(status: status, status_reason: body["reason"].to_s.truncate(255).presence)
+          record!(Event::SIGNAL_STREAM_UPDATED, stream, status: status)
+
+          render json: stream.state
+        end
+      end
+
+      def verify
+        receiving do |client|
+          stream = stream!(client_stream(client))
+
+          raise Invalid, "a disabled stream cannot be verified" if stream.status == SignalStream::DISABLED
+
+          SignalJob.perform_later(stream.id, state: body["state"].to_s.truncate(255))
+
+          head :no_content
+        end
+      end
+
+      private
+
+        def receiving
+          with_access_token(scope: Scopes::SIGNALS) do |token|
+            client = token.client
+
+            if client.nil? || token.actor || client.public? || client.archived?
+              next render(json: refusal("a receiver authenticates with its own client credentials"), status: :forbidden)
+            end
+
+            yield client
+          end
+        end
+
+        def client_stream(client)
+          SignalStream.find_by(client: client)
+        end
+
+        def stream!(stream)
+          wanted = params[:stream_id].presence || body["stream_id"].presence
+
+          raise Missing if stream.nil? || (wanted && wanted.to_s != stream.uuid)
+
+          stream
+        end
+
+        def configure!(stream, replace:)
+          delivery = body["delivery"]
+
+          if replace || delivery
+            raise Invalid, "delivery must name a method and an endpoint_url" unless delivery.is_a?(Hash)
+            raise Invalid, "only push delivery (#{SignalStream::PUSH}) is supported" unless delivery["method"] == SignalStream::PUSH
+
+            stream.endpoint_url = delivery["endpoint_url"].to_s
+            stream.authorization_header = delivery["authorization_header"].to_s.presence
+          end
+
+          stream.events_requested = Array(body["events_requested"]) if replace || body.key?("events_requested")
+          stream.description = body["description"].to_s.truncate(255).presence if replace || body.key?("description")
+          stream.save!
+        end
+
+        def body
+          @body ||= begin
+            held = JSON.parse(request.raw_post.presence || "{}")
+            raise Invalid, "the body must be a JSON object" unless held.is_a?(Hash)
+
+            held
+          rescue JSON::ParserError
+            raise Invalid, "the body is not JSON"
+          end
+        end
+
+        def refusal(message)
+          { "error" => "invalid_request", "error_description" => message }
+        end
+
+        def record!(action, stream, **details)
+          Event.record!(action, actor: nil, by: nil, client: stream.client, stream: stream.uuid, **details)
+        end
+    end
+  end
+end

data/app/controllers/masks/server/tenant_logos_controller.rb

@@ -0,0 +1,21 @@
+module Masks
+  module Server
+    class TenantLogosController < ApplicationController
+      include ServesPictures
+
+      skip_before_action :refuse_blocked_device, only: :show
+
+      def show
+        digest = current_tenant.logo_digest
+        return head(:not_found) if digest.blank?
+
+        stamped = digest.present? && params[:v] == digest
+        caching = stamped ? "public, max-age=#{FOREVER}, immutable" : "public, max-age=#{BRIEFLY}"
+
+        deliver_picture(digest, cache_control: caching) do
+          [ Pictures::CONTENT_TYPE, TenantLogo.find_by(tenant_id: current_tenant.id)&.resized(Avatars.size(params[:size])) ]
+        end
+      end
+    end
+  end
+end

data/app/controllers/masks/server/themes_controller.rb

@@ -0,0 +1,21 @@
+module Masks
+  module Server
+    class ThemesController < ApplicationController
+      SEALED = "default-src 'none'".freeze
+
+      skip_before_action :refuse_blocked_device
+
+      def show
+        theme = Themes.find(tenant: current_tenant, digest: params[:digest])
+
+        return head :not_found if theme.nil?
+
+        response.headers["X-Content-Type-Options"] = "nosniff"
+        response.headers["Content-Security-Policy"] = SEALED
+        response.headers["Cache-Control"] = "public, max-age=#{1.year.to_i}, immutable"
+
+        send_data theme.body, type: "text/css; charset=utf-8", disposition: "inline"
+      end
+    end
+  end
+end

data/app/controllers/masks/server/tokens_controller.rb

@@ -0,0 +1,360 @@
+module Masks
+  module Server
+    class TokensController < ApplicationController
+      include RackOAuth2Endpoint
+      include ClientAuthentication
+
+      EXCHANGE = Rack::OAuth2::Server::Token::Extension::TokenExchange::GRANT_TYPE_URN
+      DEVICE = Rack::OAuth2::Server::Token::Extension::DeviceCode::GRANT_TYPE_URN
+
+      skip_forgery_protection
+
+      rate_limit to: 60, within: 1.minute,
+                 by: -> { [ current_tenant.id, request.remote_ip ].join(":") },
+                 with: -> { slow_down }
+
+      def create
+        return unsupported_grant_type unless Client::GRANT_TYPES.include?(params[:grant_type].to_s)
+
+        render_rack(endpoint.call(request.env))
+      end
+
+      private
+
+        def endpoint
+          Rack::OAuth2::Server::Token.new do |req, res|
+            client = authenticate_client!(req)
+
+            holding!(req, client)
+
+            case req.grant_type.to_s
+            when "authorization_code" then exchange_code(req, res, client)
+            when "refresh_token" then refresh(req, res, client)
+            when DEVICE then redeem_device(req, res, client)
+            when EXCHANGE then exchange_token(req, res, client)
+            when Client::CLIENT_CREDENTIALS then client_credentials(req, res, client)
+            else req.unsupported_grant_type!
+            end
+          end
+        end
+
+        def proof
+          return @proof if defined?(@proof)
+
+          @proof = if Proof.presented?(request)
+            Proof.read!(request, url: "#{issuer.url}#{request.path}")
+          end
+        end
+
+        def jkt
+          proof&.jkt
+        end
+
+        def holding!(req, client)
+          if proof.nil? && client.dpop_bound_access_tokens?
+            req.bad_request!(:invalid_dpop_proof, "this client has to hold its tokens to a key")
+          end
+        rescue Proof::Refused => refusal
+          req.bad_request!(:invalid_dpop_proof, refusal.message)
+        end
+
+        def held!(req, token)
+          return if token.nil? || !token.bound?
+
+          unless token.bound_to?(proof)
+            req.bad_request!(:invalid_dpop_proof, "that grant is held to a key this proof does not carry")
+          end
+        end
+
+        def unsupported_grant_type
+          render json: {
+            "error" => "unsupported_grant_type",
+            "error_description" => "this server does not support that grant_type"
+          }, status: :bad_request
+        end
+
+        def slow_down
+          render json: {
+            "error" => "slow_down",
+            "error_description" => "too many token requests from this address"
+          }, status: :too_many_requests
+        end
+
+        def exchange_code(req, res, client)
+          code = AuthorizationCode.claim(req.code)
+
+          if code.nil?
+            AuthorizationCode.spent(req.code)&.revoke_issued!
+            req.invalid_grant!("that code is not valid or has expired")
+          end
+          req.invalid_grant!("that code was issued to another client") if code.client_id != client.id
+
+          unless code.redirect_uri == req.redirect_uri.to_s
+            req.invalid_grant!("redirect_uri does not match the one the code was issued for")
+          end
+
+          unless code.verifies?(req.code_verifier)
+            req.invalid_grant!("code_verifier does not match the challenge")
+          end
+
+          held!(req, code)
+          member!(req, code)
+          Current.organization = code.organization
+
+          audience = narrow(req, code.audience, client)
+          access = AccessToken.issue!(
+            issuer: issuer, actor: code.actor, client: client,
+            scopes: code.scopes, audience: audience, parent: code,
+            requested_claims: code.requested_claims, jkt: jkt,
+            authorization_details: detailed(req, code.authorization_details)
+          )
+
+          res.access_token = Payload.new(issued(access, code, client))
+        end
+
+        def refresh(req, res, client)
+          held!(req, RefreshToken.redeem(req.refresh_token))
+
+          token = RefreshToken.claim(req.refresh_token)
+
+          if token.nil?
+            replayed!(RefreshToken.spent(req.refresh_token), client)
+            req.invalid_grant!("that refresh token is not valid or has expired")
+          end
+
+          req.invalid_grant!("that refresh token was issued to another client") if token.client_id != client.id
+          req.invalid_grant!("the session that refresh token was issued in has ended") if outlived?(token)
+          member!(req, token)
+          consented!(req, token, client)
+          Current.organization = token.organization
+
+          held = token.bound? ? token.jkt : jkt
+          scopes = still_held(token, client, req.scope.present? ? Scopes.granted(req.scope, token.scopes) : token.scope_list)
+          audience = narrow(req, token.audience, client)
+
+          access = AccessToken.issue!(
+            issuer: issuer, actor: token.actor, client: client,
+            scopes: scopes, audience: audience, parent: token, jkt: held,
+            authorization_details: detailed(req, token.authorization_details)
+          )
+
+          rotated = RefreshToken.mint!(
+            actor: token.actor, client: client, parent: token,
+            scopes: Scopes.join(scopes), audience: audience, jkt: held,
+            authorization_details: token.authorization_details,
+            expires_at: client.refresh_lifetime.from_now
+          )
+
+          res.access_token = Payload.new(bearer(access).merge(
+            "refresh_token" => rotated.secret,
+            "delegations" => delegated(token.actor, client, scopes)
+          ).compact)
+        end
+
+        def consented!(req, token, client)
+          return if token.actor.nil?
+
+          consent = Consent.find_by(actor: token.actor, client: client)
+
+          req.invalid_grant!("consent for #{client.name} has lapsed or was withdrawn") if consent && !consent.live?
+          req.invalid_grant!("#{token.actor.identifier} may no longer use #{client.name}") unless client.admits?(token.actor)
+        end
+
+        def still_held(token, client, scopes)
+          held = Scopes.list(scopes) & client.permitted_scopes(scopes)
+
+          token.actor ? held & token.actor.permitted_scopes(held) : held
+        end
+
+        def member!(req, grant)
+          held = grant.organization
+
+          return if held.nil? || held.membership_for(grant.actor)
+
+          req.invalid_grant!("#{grant.actor&.identifier || 'that account'} is no longer a member of #{held.name}")
+        end
+
+        def outlived?(token)
+          held = token.session
+
+          held.present? && held.bounded? && !held.live?
+        end
+
+        def replayed!(spent, client)
+          return if spent.nil? || !spent.consumed?
+
+          revoked = spent.revoke_family!
+
+          Event.record!(
+            Event::REFRESH_REUSED,
+            actor: spent.actor, by: nil, client: client,
+            issued_to: spent.client&.client_id, revoked: revoked
+          )
+        end
+
+        def redeem_device(req, res, client)
+          grant = DeviceGrant.spent(req.device_code)
+
+          unless client.grants?(DeviceGrant::GRANT_TYPE)
+            req.bad_request!(:unauthorized_client, "this client is not registered for the device grant")
+          end
+
+          if grant.nil? || grant.client_id != client.id
+            req.invalid_grant!("that device code is not valid")
+          end
+
+          req.bad_request!(:access_denied, "the person turned this device away") if grant.denied?
+          req.invalid_grant!("that device code has already been used") if grant.consumed?
+          req.bad_request!(:expired_token, "that device code has expired") unless grant.live?
+
+          if grant.hurried?
+            req.bad_request!(:slow_down, "poll no more often than every #{grant.interval} seconds")
+          end
+
+          unless grant.approved?
+            req.bad_request!(:authorization_pending, "nobody has approved this device yet")
+          end
+
+          claimed = DeviceGrant.claim(req.device_code)
+
+          req.invalid_grant!("that device code has already been used") if claimed.nil?
+
+          member!(req, claimed)
+          Current.organization = claimed.organization
+
+          res.access_token = Payload.new(issued(claimed.issue!(issuer: issuer, jkt: jkt), claimed, client))
+        end
+
+        def exchange_token(req, res, client)
+          Exchange.new(
+            client: client,
+            issuer: issuer,
+            subject_token: req.subject_token,
+            subject_token_type: req.subject_token_type,
+            actor_token: params[:actor_token],
+            actor_token_type: params[:actor_token_type],
+            requested_token_type: req.requested_token_type,
+            scope: req.scope,
+            resource: repeated("resource"),
+            lifetime: req.requested_lifetime,
+            audience: repeated("audience"),
+            authorization_details: params[:authorization_details],
+            proof: proof
+          ).then { |exchange| res.access_token = Payload.new(exchange.perform!(jkt: jkt) { |access| bearer(access) }) }
+        end
+
+        def client_credentials(req, res, client)
+          unless client.grants?(Client::CLIENT_CREDENTIALS) && client.approved? && !client.public?
+            req.bad_request!(:unauthorized_client, "this client is not registered for client_credentials")
+          end
+
+          if params[:authorization_details].present?
+            req.bad_request!(:invalid_authorization_details, "authorization_details is not offered for client_credentials")
+          end
+
+          available = client.unattended_scopes
+          requested = Scopes.list(req.scope)
+          refused = Scopes.refused(available, requested)
+
+          if refused.any?
+            req.bad_request!(:invalid_scope, "this client may not ask for #{refused.join(', ')} on its own behalf")
+          end
+
+          scopes = requested.presence || Scopes.concrete(available)
+
+          req.bad_request!(:invalid_scope, "this client has no scope it may hold on its own behalf") if scopes.empty?
+
+          access = AccessToken.issue!(
+            issuer: issuer, actor: nil, client: client,
+            scopes: scopes, audience: narrow(req, client.resources, client), jkt: jkt
+          )
+
+          res.access_token = Payload.new(bearer(access))
+        end
+
+        def bearer(access)
+          {
+            "access_token" => access.jwt,
+            "token_type" => access.token_type,
+            "expires_in" => access.expires_in,
+            "scope" => Scopes.join(access.scopes),
+            "authorization_details" => access.authorization_details.presence
+          }.compact
+        end
+
+        def issued(access, grant, client)
+          body = bearer(access)
+
+          if access.scope_list.include?(Scopes::OPENID)
+            body["id_token"] = issuer.id_token(
+              actor: grant.actor, client: client, nonce: grant.nonce,
+              authenticated_at: grant.authenticated_at,
+              amr: grant.held("amr"),
+              access_token: access.jwt,
+              sid: grant.session&.uuid,
+              organization: access.organization,
+              groups: (grant.actor.group_labels if access.scope_list.include?(Scopes::GROUPS))
+            )
+          end
+
+          if access.scope_list.include?(Scopes::OFFLINE)
+            body["refresh_token"] = RefreshToken.mint!(
+              actor: grant.actor, client: client, parent: grant,
+              scopes: access.scopes, audience: access.audience, jkt: access.jkt,
+              authorization_details: grant.authorization_details,
+              expires_at: client.refresh_lifetime.from_now
+            ).secret
+          end
+
+          body.merge("delegations" => delegated(grant.actor, client, access.scopes)).compact
+        end
+
+        def delegated(actor, client, scopes)
+          wanted = Scopes.delegations(scopes).filter_map { |scope| Scopes.delegated_provider(scope) }
+
+          return nil if wanted.empty? || actor.nil?
+
+          Delegation.live.joins(connection: :provider)
+            .where(client: client, actor: actor, providers: { key: wanted })
+            .merge(Connection.live)
+            .includes(connection: :provider)
+            .map do |delegation|
+              {
+                "connection" => delegation.connection.uuid,
+                "provider" => delegation.connection.provider.key,
+                "provider_name" => delegation.connection.provider.name,
+                "label" => delegation.connection.label,
+                "subject" => issuer.subject_for(actor, client)
+              }.compact
+            end
+        end
+
+        def detailed(req, granted)
+          AuthorizationDetails.narrow!(params[:authorization_details], granted)&.as_json || granted
+        rescue AuthorizationDetails::Invalid => e
+          req.bad_request!(:invalid_authorization_details, e.message)
+        end
+
+        def narrow(req, granted, client)
+          requested = repeated("resource")
+          held = granted.presence || [ client.client_id ]
+
+          return held if requested.empty?
+
+          refused = requested - held
+
+          if refused.any?
+            req.bad_request!(:invalid_target, "resource was not authorized: #{refused.join(', ')}")
+          end
+
+          requested
+        end
+
+        def authenticate_client!(req)
+          authenticated_client
+        rescue Policy::Denied => denial
+          req.invalid_client!(denial.description)
+        end
+    end
+  end
+end

data/app/controllers/masks/server/userinfo_controller.rb

@@ -0,0 +1,30 @@
+module Masks
+  module Server
+    class UserinfoController < ApplicationController
+      include RackOAuth2Endpoint
+      include ResourceToken
+
+      skip_forgery_protection
+
+      def show
+        with_access_token(scope: Scopes::OPENID) do |token|
+          actor = token.actor
+
+          next refuse_token("that token has no subject") if actor.nil?
+
+          claims = actor.claims(
+            token.scopes,
+            requested: token.requested_claims,
+            origin: issuer.url,
+            subject: issuer.subject_for(actor, token.client)
+          )
+          standard = OpenIDConnect::ResponseObject::UserInfo.new(claims.symbolize_keys).as_json
+
+          render json: standard.merge(claims.slice(Actor::AVATARS_CLAIM, Actor::IDENTITIES_CLAIM, Actor::ORGANIZATIONS_CLAIM,
+                                                Actor::GROUPS_CLAIM))
+                               .merge({ Organization::CLAIM => token.organization_claim }.compact)
+        end
+      end
+    end
+  end
+end

data/app/controllers/masks/server/verifications_controller.rb

@@ -0,0 +1,32 @@
+module Masks
+  module Server
+    class VerificationsController < ApplicationController
+      rate_limit to: ::Rails.configuration.masks.recovery_limit,
+                 within: 15.minutes,
+                 by: -> { [ current_tenant.id, current_actor&.id ].join(":") },
+                 with: -> { redirect_to root_path, alert: t("verifications.too_many_requests") }
+
+      before_action :require_actor
+
+      def create
+        return refuse(t("verifications.no_address")) if current_actor.email.blank?
+        return refuse(t("verifications.already_confirmed")) if current_actor.email_verified_at.present?
+        return refuse(t("verifications.no_mailer")) unless ActorMailer.deliverable?
+
+        Verifications.open(actor: current_actor, journey: Journey.account(current_actor))
+
+        redirect_to root_path, notice: t("verifications.sent", email: current_actor.email)
+      end
+
+      private
+
+        def require_actor
+          redirect_to login_path unless current_actor
+        end
+
+        def refuse(message)
+          redirect_to root_path, alert: message
+        end
+    end
+  end
+end