masks-server 0.7.0

data/lib/masks/server/schema_reference.rb

@@ -0,0 +1,164 @@
+module Masks
+  module Server
+    class SchemaReference
+      SECTIONS = [
+        [ "Queries", :query_root ],
+        [ "Mutations", :mutation_root ],
+        [ "Objects", :objects ],
+        [ "Inputs", :inputs ],
+        [ "Enums", :enums ],
+        [ "Scalars", :scalars ]
+      ].freeze
+
+      def initialize(schema)
+        @schema = schema
+      end
+
+      def page
+        [ frontmatter, *SECTIONS.filter_map { |title, source| section(title, send(source)) } ].join("\n")
+      end
+
+      private
+
+        attr_reader :schema
+
+        def frontmatter
+          <<~HEAD
+            ---
+            title: Manage API
+            description: The GraphQL schema served at /manage/graphql.
+            ---
+
+            Everything `/manage` can ask for and everything it can change. `/manage/graphql` accepts a
+            bearer carrying `masks:manage` or one of the narrower
+            [manage roles](/guides/security/#manage-roles), issued for this tenant's manage resource and
+            no other. A mutation the bearer's roles do not cover answers with an error naming the scopes
+            it needs.
+
+            Generated from `ManageSchema` by `./dev reference`. CI fails when this page and the
+            schema disagree.
+          HEAD
+        end
+
+        def section(title, types)
+          return nil if types.empty?
+
+          [ "## #{title}\n", *types.map { |type| describe(type) } ].join("\n")
+        end
+
+        def describe(type)
+          body = if type.kind.enum?
+            values(type)
+          elsif type.kind.scalar?
+            "A scalar. Serialized as a string unless a client says otherwise.\n"
+          else
+            fields(type)
+          end
+
+          "### #{type.graphql_name}\n\n#{documentation(type)}#{body}"
+        end
+
+        def documentation(type)
+          described = type.description.to_s.strip
+
+          described.empty? ? "" : "#{described}\n\n"
+        end
+
+        def values(type)
+          described = type.values.values.map { |value| value.description.to_s.strip }
+
+          rows = type.values.values.zip(described).map do |value, text|
+            cells([ "`#{value.graphql_name}`", text ], described)
+          end
+
+          table([ "Value", "Description" ], rows, described)
+        end
+
+        def fields(type)
+          described = type.fields.values.map { |field| field.description.to_s.strip }
+
+          rows = type.fields.values.zip(described).map do |field, text|
+            cells([ signature(field), link(field.type), text ], described)
+          end
+
+          table([ "Field", "Type", "Description" ], rows, described)
+        end
+
+        # A field and its arguments share one cell, each on its own line, so a
+        # mutation taking fourteen of them does not set the width of the table.
+        def signature(field)
+          named = "`#{field.graphql_name}`"
+          return named if field.arguments.empty?
+
+          taken = field.arguments.values.map do |argument|
+            "<br />`#{argument.graphql_name}: #{argument.type.to_type_signature}`"
+          end
+
+          "#{named}#{taken.join}"
+        end
+
+        # Every description in this schema is empty, because the code carries no
+        # comments. An empty column on every row is noise, so it only appears when
+        # something in that table actually filled it in.
+        def cells(values, described)
+          kept = described.any?(&:present?) ? values : values[0..-2]
+
+          "| #{kept.join(' | ')} |"
+        end
+
+        def link(type)
+          named = type.unwrap
+          shown = type.to_type_signature
+
+          return "`#{shown}`" if named.introspection? || named.kind.scalar?
+
+          "[`#{shown}`](##{named.graphql_name.downcase})"
+        end
+
+        def table(headings, rows, described)
+          return "None.\n" if rows.empty?
+
+          kept = described.any?(&:present?) ? headings : headings[0..-2]
+
+          [
+            "| #{kept.join(' | ')} |",
+            "| #{kept.map { '---' }.join(' | ')} |",
+            *rows,
+            ""
+          ].join("\n")
+        end
+
+        def declared
+          @declared ||= schema.types.values.reject(&:introspection?).sort_by(&:graphql_name)
+        end
+
+        def roots
+          [ schema.query, schema.mutation ].compact
+        end
+
+        def query_root
+          [ schema.query ].compact
+        end
+
+        def mutation_root
+          [ schema.mutation ].compact
+        end
+
+        def objects
+          declared.select { |type| type.kind.object? } - roots
+        end
+
+        def inputs
+          declared.select { |type| type.kind.input_object? }
+        end
+
+        def enums
+          declared.select { |type| type.kind.enum? }
+        end
+
+        def scalars
+          declared.select { |type| type.kind.scalar? && !type.default_scalar? }
+        end
+    end
+  end
+end

data/lib/masks/server/tenancy/job.rb

@@ -0,0 +1,78 @@
+module Masks
+  module Server
+    module Tenancy
+      module Job
+        extend ActiveSupport::Concern
+
+        KEY = "tenant".freeze
+        EVERY = "*".freeze
+
+        class Homeless < StandardError
+          def initialize(job)
+            super(
+              "#{job} was reached outside any tenant. A job carries the tenant it was enqueued in so " \
+              "that it reads the same rows the request did; without one it would perform against " \
+              "whichever tenant its worker thread happened to hold last. Enqueue it inside " \
+              "Tenant.switch, or declare across_tenants! on it if it is maintenance meant to span " \
+              "every tenant."
+            )
+          end
+        end
+
+        included do
+          class_attribute :across_tenants, instance_accessor: false, default: false
+
+          self.enqueue_after_transaction_commit = true
+        end
+
+        class_methods do
+          def across_tenants!
+            self.across_tenants = true
+          end
+        end
+
+        def initialize(...)
+          super
+
+          @tenant_held = Current.tenant&.uuid
+        end
+
+        def serialize
+          super.merge(KEY => enqueued_in)
+        end
+
+        def deserialize(job_data)
+          super
+
+          @tenant_carried = true
+          @tenant_held = job_data[KEY]
+        end
+
+        def perform_now
+          within_tenant { super }
+        end
+
+        def within_tenant(&block)
+          return yield if self.class.across_tenants || @tenant_held == EVERY
+          return yield if @tenant_held.blank? && !@tenant_carried
+
+          raise Homeless, self.class.name if @tenant_held.blank?
+
+          Tenant.switch(held_tenant, &block)
+        end
+
+        def held_tenant
+          @tenant_held.presence && Tenant.active.find_by!(uuid: @tenant_held)
+        end
+
+        private
+
+          def enqueued_in
+            return EVERY if self.class.across_tenants
+
+            @tenant_held || Current.tenant&.uuid || raise(Homeless, self.class.name)
+          end
+      end
+    end
+  end
+end

data/lib/masks/server/tenancy/middleware.rb

@@ -0,0 +1,104 @@
+module Masks
+  module Server
+    module Tenancy
+      class Middleware
+        UNSERVED = "no tenant is served at this hostname".freeze
+        CROWDED = "too many tenants were claimed recently; try again later".freeze
+        CLAIM_WINDOW = 1.hour
+        TENANTLESS = %w[/up /metrics].freeze
+        TLS_ASK = "/tls/allowed".freeze
+
+        def initialize(app)
+          @app = app
+        end
+
+        def call(env)
+          request = ActionDispatch::Request.new(env)
+
+          return @app.call(env) if TENANTLESS.include?(request.path)
+          return allowed(request) if request.path == TLS_ASK
+
+          tenant = Tenant.serving(request.host)
+
+          return unserved unless tenant || templated?(request)
+
+          tenant ||= Tenant.named(request.host)
+
+          if tenant.nil?
+            return crowded if Tenant.claiming? && crowded?(request)
+
+            tenant = Tenant.claim(request.host)
+          end
+
+          return unserved if tenant.nil?
+
+          origin = origin_for(request, tenant)
+
+          return unserved if origin.nil?
+
+          Current.origin = origin
+          Current.ip_address = request.remote_ip
+          Current.user_agent = request.user_agent
+
+          Tenant.switch(tenant) { @app.call(env) }
+        end
+
+        private
+
+          def templated?(request)
+            template = ::Rails.configuration.masks.public_origin_template
+
+            return true if template.nil?
+
+            host_of(format(template, subdomain: request.host.to_s.split(".").first))&.casecmp?(request.host.to_s)
+          end
+
+          def host_of(origin)
+            URI.parse(origin).host
+          rescue URI::InvalidURIError
+            nil
+          end
+
+          def origin_for(request, tenant)
+            return "#{request.base_url}#{request.script_name}" if ::Rails.configuration.masks.public_origin_template.nil?
+            return tenant.custom_origin if tenant.custom_host&.casecmp?(request.host.to_s)
+
+            canonical = tenant.templated_origin
+
+            canonical if host_of(canonical)&.casecmp?(request.host.to_s)
+          end
+
+          def allowed(request)
+            served = Tenant.serving(request.params["domain"])
+
+            [ served ? 200 : 404, { "content-type" => "text/plain; charset=utf-8", "cache-control" => "no-store" }, [] ]
+          end
+
+          def crowded?(request)
+            window = Time.current.to_i / CLAIM_WINDOW.to_i
+            from_here = ::Rails.cache.increment("tenant-claims:#{window}:#{request.remote_ip}", 1, expires_in: CLAIM_WINDOW)
+            from_anywhere = ::Rails.cache.increment("tenant-claims:#{window}", 1, expires_in: CLAIM_WINDOW)
+
+            from_here.to_i > ::Rails.configuration.masks.claim_limit ||
+              from_anywhere.to_i > ::Rails.configuration.masks.claim_ceiling
+          end
+
+          def crowded
+            [
+              429,
+              { "content-type" => "text/plain; charset=utf-8", "cache-control" => "no-store", "retry-after" => CLAIM_WINDOW.to_i.to_s },
+              [ CROWDED ]
+            ]
+          end
+
+          def unserved
+            [
+              404,
+              { "content-type" => "text/plain; charset=utf-8", "cache-control" => "no-store" },
+              [ UNSERVED ]
+            ]
+          end
+      end
+    end
+  end
+end

data/lib/masks/server/tenant_isolation.rb

@@ -0,0 +1,40 @@
+module Masks
+  module Server
+    module TenantIsolation
+      SETTING = "masks.tenant_id".freeze
+
+      def self.adopt(connection)
+        connection.exec_query("SELECT set_config($1, $2, false)", "tenant", [ SETTING, Current.tenant&.id.to_s ])
+      rescue ActiveRecord::NoDatabaseError, ActiveRecord::ConnectionNotEstablished, ActiveRecord::ConnectionFailed
+        nil
+      end
+
+      def enable_row_level_security(table)
+        execute <<~SQL
+          ALTER TABLE #{table} ENABLE ROW LEVEL SECURITY;
+          ALTER TABLE #{table} FORCE ROW LEVEL SECURITY;
+
+          CREATE POLICY tenant_isolation ON #{table}
+            USING (tenant_id = NULLIF(current_setting('#{SETTING}', true), '')::bigint)
+            WITH CHECK (tenant_id = NULLIF(current_setting('#{SETTING}', true), '')::bigint);
+        SQL
+      end
+
+      def across_tenants(table)
+        execute "ALTER TABLE #{table} NO FORCE ROW LEVEL SECURITY"
+
+        yield
+      ensure
+        execute "ALTER TABLE #{table} FORCE ROW LEVEL SECURITY"
+      end
+
+      def disable_row_level_security(table)
+        execute <<~SQL
+          DROP POLICY IF EXISTS tenant_isolation ON #{table};
+          ALTER TABLE #{table} NO FORCE ROW LEVEL SECURITY;
+          ALTER TABLE #{table} DISABLE ROW LEVEL SECURITY;
+        SQL
+      end
+    end
+  end
+end

data/lib/masks/server/tenant_key_provider.rb

@@ -0,0 +1,76 @@
+require "openssl"
+
+module Masks
+  module Server
+    class TenantKeyProvider
+      class NoTenant < StandardError
+        def initialize(message = "a tenant's encrypted column was read or written outside that tenant. Each tenant's " \
+                                 "secrets are encrypted under a key of its own, so switch to the tenant first.")
+          super
+        end
+      end
+
+      LABEL = "masks/encryption/tenant/".freeze
+      KEYED = :masks_keyed_tenant
+
+      class << self
+        def keyed(tenant)
+          held = ActiveSupport::IsolatedExecutionState[KEYED]
+          ActiveSupport::IsolatedExecutionState[KEYED] = tenant
+
+          begin
+            yield
+          ensure
+            ActiveSupport::IsolatedExecutionState[KEYED] = held
+          end
+        end
+
+        def tenant
+          ActiveSupport::IsolatedExecutionState[KEYED] || Current.tenant
+        end
+      end
+
+      def initialize(shared = nil, keyed: false)
+        @shared = shared
+        @keyed = keyed
+      end
+
+      def shared
+        @shared || ActiveRecord::Encryption.key_provider
+      end
+
+      def encryption_key
+        derive(shared.encryption_key, tenant!)
+      end
+
+      def decryption_keys(message)
+        tenant = tenant!
+        held = Array(shared.decryption_keys(message)).reverse
+
+        held.map { |key| derive(key, tenant) } + held
+      end
+
+      def tenant_keys(tenant)
+        ActiveRecord::Encryption::KeyProvider.new(
+          Array(shared.decryption_keys(ActiveRecord::Encryption::Message.new)).map { |key| derive(key, tenant) }
+        )
+      end
+
+      private
+
+        def tenant!
+          tenant = @keyed ? self.class.tenant : Current.tenant
+          raise NoTenant if tenant.nil? || tenant.uuid.blank?
+
+          tenant
+        end
+
+        def derive(key, tenant)
+          ActiveRecord::Encryption::Key.new(
+            OpenSSL::KDF.hkdf(key.secret, salt: "", info: "#{LABEL}#{tenant.uuid}",
+                                          length: ActiveRecord::Encryption.cipher.key_length, hash: "SHA256")
+          )
+        end
+    end
+  end
+end

data/lib/masks/server/version.rb

@@ -0,0 +1,5 @@
+module Masks
+  module Server
+    VERSION = File.read(File.expand_path("../../../version.txt", __dir__)).strip.freeze
+  end
+end

data/lib/masks/server.rb

@@ -0,0 +1,116 @@
+require "rails-i18n"
+require "bcrypt"
+require "jwt"
+require "ruby-saml"
+require "rack/oauth2"
+require "openid_connect"
+require "rqrcode"
+require "rotp"
+require "webauthn"
+require "fido_metadata"
+require "device_detector"
+require "graphql"
+require "premailer/rails"
+require "vite_rails"
+
+module Masks
+  PROTOCOL_VERSION = 1
+
+  def self.to_bool(val, default: false)
+    return default if val.nil?
+
+    ActiveModel::Type::Boolean.new.cast(val)
+  end
+
+  module Server
+    class << self
+      def table_name_prefix
+        ""
+      end
+
+      def config
+        ::Rails.application.config.masks
+      end
+
+      def engine?
+        config.mode == :engine
+      end
+
+      def secret_key_base
+        return ::Rails.application.secret_key_base unless engine?
+
+        config.secret.presence ||
+          ::Rails.application.key_generator.generate_key("masks/server secret_key_base", 64).unpack1("H*")
+      end
+
+      def key_generator
+        return ::Rails.application.key_generator unless engine?
+
+        @key_generator ||= ActiveSupport::CachingKeyGenerator.new(
+          ActiveSupport::KeyGenerator.new(secret_key_base, iterations: 1000)
+        )
+      end
+
+      def message_verifier(purpose)
+        return ::Rails.application.message_verifier(purpose) unless engine?
+
+        ActiveSupport::MessageVerifier.new(key_generator.generate_key("masks/server #{purpose}"))
+      end
+
+      def actor_for(request)
+        tenant = Tenant.resolve(request.host)
+        return nil if tenant.nil?
+
+        secret = cookies_for(request).encrypted[:masks_session]
+        return nil if secret.blank?
+
+        Tenant.switch(tenant) { Session.resume(secret)&.actor }
+      end
+
+      def cookies_for(request)
+        env = request.env.except("action_dispatch.cookies").merge(
+          "action_dispatch.key_generator" => key_generator,
+          "action_dispatch.secret_key_base" => secret_key_base,
+          "action_dispatch.cookies_rotations" => ActiveSupport::Messages::RotationConfiguration.new
+        )
+
+        ActionDispatch::Request.new(env).cookie_jar
+      end
+
+      def vite_ruby
+        @vite_ruby ||= ViteRuby.new(
+          root: Engine.root, public_dir: "public", public_output_dir: "masks-assets",
+          mode: "production", auto_build: false, skip_proxy: true
+        )
+      end
+
+      def key_provider
+        @key_provider ||= TenantKeyProvider.new(shared_key_provider)
+      end
+
+      def tenant_key_provider
+        @tenant_key_provider ||= TenantKeyProvider.new(shared_key_provider, keyed: true)
+      end
+
+      def shared_key_provider
+        return nil unless engine?
+
+        @shared_key_provider ||= ActiveRecord::Encryption::KeyProvider.new(
+          ActiveRecord::Encryption::Key.new(key_generator.generate_key("masks/server encryption", 32))
+        )
+      end
+    end
+  end
+end
+
+require_relative "server/version"
+require_relative "server/configuration"
+require_relative "server/isolation"
+require_relative "server/tenant_key_provider"
+require_relative "server/forwarding"
+require_relative "server/forwarded_app"
+require_relative "server/host"
+require_relative "server/tenant_isolation"
+require_relative "server/tenancy/job"
+require_relative "server/tenancy/middleware"
+require_relative "server/engine"

data/lib/masks-server.rb

@@ -0,0 +1 @@
+require_relative "masks/server"

data/lib/puma/plugin/masks_ldap.rb

@@ -0,0 +1,25 @@
+require "puma/plugin"
+
+Puma::Plugin.create do
+  def start(launcher)
+    @log_writer = launcher.log_writer
+
+    launcher.events.after_booted { listen }
+    launcher.events.after_stopped { stop }
+    launcher.events.before_restart { stop }
+  end
+
+  private
+
+    def listen
+      @listener = Masks::Server::Ldap::Listener.from_configuration.start
+    rescue NameError
+      @log_writer.log("masks ldap: the app is not loaded in this process, so LDAP is not served")
+    rescue SystemCallError, OpenSSL::OpenSSLError => e
+      @log_writer.log("masks ldap: not listening: #{e.message}")
+    end
+
+    def stop
+      Thread.new { @listener&.stop }.join
+    end
+end

data/lib/rack/oauth2/server/token/extension/device_code.rb

@@ -0,0 +1,40 @@
+require "rack/oauth2"
+
+module Rack
+  module OAuth2
+    module Server
+      class Token
+        module Extension
+          class DeviceCode < Abstract::Handler
+            GRANT_TYPE_URN = "urn:ietf:params:oauth:grant-type:device_code".freeze
+
+            class << self
+              def grant_type_for?(grant_type)
+                grant_type == GRANT_TYPE_URN
+              end
+            end
+
+            def _call(env)
+              @request = Request.new(env)
+              @response = Response.new(request)
+              super
+            end
+
+            class Request < Token::Request
+              attr_required :device_code
+
+              def initialize(env)
+                super
+
+                @grant_type = GRANT_TYPE_URN
+                @device_code = params["device_code"]
+
+                attr_missing!
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end