masks-server 0.7.0

data/app/graphql/masks/server/manage/mutations/activate_signing_key.rb

@@ -0,0 +1,26 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class ActivateSigningKey < BaseMutation
+          requires :security
+
+          argument :kid, ID
+
+          field :signing_key, Types::SigningKeyType, null: false
+
+          def resolve(kid:)
+            key = signing_key!(kid)
+
+            refuse!("that key is already signing") if key.active?
+            refuse!("a retired key cannot be activated") unless key.staged?
+
+            audit!(Masks::Server::Event::SIGNING_KEY_ACTIVATED, kid: key.kid)
+
+            { signing_key: key.activate! }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/add_app.rb

@@ -0,0 +1,64 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class AddApp < BaseMutation
+          requires :security
+
+          argument :preset, ID
+          argument :base_url, String, description: "Where the app is served, such as https://grafana.example.com."
+          argument :name, String, required: false, description: "What people see. The preset's name when left out."
+          argument :slug, String, required: false,
+                   description: "The name some apps put in their redirect URI, such as Gitea's authentication source."
+
+          field :client, Types::ClientType, null: false
+          field :secret, String
+          field :settings, [ Types::AppSettingType ], null: false
+          field :guide, String
+
+          def resolve(preset:, base_url:, name: nil, slug: nil)
+            found = Masks::Server::AppPreset.find(preset) || refuse!("no app preset called #{preset}")
+
+            client = Masks::Server::Client.new(
+              client_id: SecureRandom.uuid,
+              name: name.presence || (found.forward? ? URI.parse(base_url.to_s).host : found.name),
+              redirect_uris: found.redirect_uris(base: base_url, name: slug),
+              allowed_scopes: Scopes.join(found.scopes),
+              client_uri: base_url.to_s.strip.delete_suffix("/"),
+              consent_required: false,
+              dynamic: false,
+              approved_at: Time.current,
+              approved_by: viewer,
+              **(found.forward? ? forwarded : redirected)
+            )
+
+            secret = client.issue_secret! unless found.forward?
+            save!(client)
+
+            audit!(Masks::Server::Event::CLIENT_CREATED, client: client, name: client.name, preset: found.key)
+
+            {
+              client: client, secret: secret, guide: found.guide,
+              settings: found.settings(base: base_url, issuer: context[:issuer], client: client, secret: secret, name: slug)
+            }
+          rescue Masks::Server::AppPreset::Unusable, URI::InvalidURIError => e
+            refuse!(e.message)
+          end
+
+          private
+
+            def forwarded
+              { protocol: Masks::Server::Client::FORWARD, grant_types: [], response_types: [],
+                token_endpoint_auth_method: "none" }
+            end
+
+            def redirected
+              { grant_types: %w[authorization_code refresh_token],
+                response_types: Masks::Server::Client.response_types_for(%w[authorization_code]),
+                token_endpoint_auth_method: Masks::Server::Client::DEFAULT_AUTH_METHOD }
+            end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/add_group_member.rb

@@ -0,0 +1,25 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class AddGroupMember < BaseMutation
+          requires :security
+
+          argument :key, String
+          argument :uuid, ID
+
+          field :group, Types::GroupType, null: false
+
+          def resolve(key:, uuid:)
+            group = group!(key)
+            actor = actor!(uuid)
+
+            group.add!(actor, by: viewer)
+
+            { group: group }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/add_member.rb

@@ -0,0 +1,36 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class AddMember < OrganizationMutation
+          requires :support
+
+          description "Adds a person to an organization. Name an existing account by uuid, or an email " \
+                      "address, which invites a new account when none holds it."
+
+          argument :organization, ID
+          argument :role, String
+          argument :uuid, ID, required: false
+          argument :email, String, required: false
+
+          field :membership, Types::MembershipType, null: false
+          field :delivered, Boolean, null: false
+          field :url, String
+
+          def resolve(organization:, role:, uuid: nil, email: nil)
+            refuse!("name the person by uuid or by email, not both") if uuid && email
+            refuse!("name the person by uuid or by email") if uuid.nil? && email.blank?
+
+            held = live!(organization!(organization))
+            actor = uuid ? actor!(uuid) : Actor.locate(email)&.then { |found| managed!(found) }
+
+            Masks::Server::Members.add!(organization: held, role: role, by: viewer, actor: actor, email: email,
+                                        journey: Masks::Server::Journey.manage(viewer), manager: true)
+          rescue Masks::Server::Members::Refused => e
+            refuse!(e.message)
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/approve_actor.rb

@@ -0,0 +1,25 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class ApproveActor < BaseMutation
+          requires :support
+
+          argument :uuid, ID
+
+          field :actor, Types::ActorType, null: false
+
+          def resolve(uuid:)
+            actor = actor!(uuid)
+
+            refuse!("#{actor.identifier} is not waiting for approval") if actor.pending_approval_at.nil?
+
+            Masks::Server::Confirmations.approve!(actor, journey: Masks::Server::Journey.manage(viewer))
+
+            { actor: actor }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/archive_client.rb

@@ -0,0 +1,30 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class ArchiveClient < BaseMutation
+          requires :security
+
+          argument :client_id, ID
+
+          field :client, Types::ClientType, null: false
+
+          def resolve(client_id:)
+            client = client!(client_id)
+
+            if client.id == context[:client]&.id
+              refuse!("that is the client you are signed in with, and archiving it would lock you out")
+            end
+
+            client.archived_at = Time.current
+            save!(client)
+
+            audit!(Masks::Server::Event::CLIENT_ARCHIVED, client: client, name: client.name)
+
+            { client: client }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/archive_event_stream.rb

@@ -0,0 +1,28 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class ArchiveEventStream < BaseMutation
+          requires :security
+
+          argument :key, ID
+
+          field :event_stream, Types::EventStreamType, null: false
+
+          def resolve(key:)
+            stream = event_stream!(key)
+
+            refuse!("#{stream.name} is already archived") if stream.archived?
+
+            stream.archived_at = Time.current
+            save!(stream)
+
+            audit!(Masks::Server::Event::STREAM_ARCHIVED, stream: stream.key)
+
+            { event_stream: stream }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/archive_organization.rb

@@ -0,0 +1,27 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class ArchiveOrganization < OrganizationMutation
+          requires :security
+
+          argument :key, ID
+
+          field :organization, Types::OrganizationType, null: false
+
+          def resolve(key:)
+            organization = organization!(key)
+
+            refuse!("#{organization.name} is already archived") if organization.archived?
+
+            organization.archive!(by: viewer)
+
+            audit!(Masks::Server::Event::ORGANIZATION_ARCHIVED, organization: organization.key)
+
+            { organization: organization }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/archive_provider.rb

@@ -0,0 +1,28 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class ArchiveProvider < BaseMutation
+          requires :security
+
+          argument :key, ID
+
+          field :provider, Types::ProviderType, null: false
+
+          def resolve(key:)
+            provider = provider!(key)
+
+            refuse!("#{provider.name} is already archived") if provider.archived?
+
+            provider.archived_at = Time.current
+            save!(provider)
+
+            audit!(Masks::Server::Event::PROVIDER_ARCHIVED, provider: provider.key, name: provider.name)
+
+            { provider: provider }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/archive_sender.rb

@@ -0,0 +1,28 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class ArchiveSender < BaseMutation
+          requires :security
+
+          argument :key, ID
+
+          field :sender, Types::SenderType, null: false
+
+          def resolve(key:)
+            sender = sender!(key)
+
+            refuse!("#{sender.name} is already archived") if sender.archived?
+
+            sender.assign_attributes(archived_at: Time.current, primary: false)
+            save!(sender)
+
+            audit!(Masks::Server::Event::SENDER_ARCHIVED, sender: sender.key, service: sender.service)
+
+            { sender: sender }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/archive_sign_in_policy.rb

@@ -0,0 +1,31 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class ArchiveSignInPolicy < BaseMutation
+          requires :security
+
+          argument :key, ID
+
+          field :sign_in_policy, Types::SignInPolicyType, null: false
+
+          def resolve(key:)
+            policy = sign_in_policy!(key)
+
+            refuse!("#{policy.name} is already archived") if policy.archived?
+            refuse!("#{policy.name} is the tenant's default; choose another default first") if
+              Current.tenant.sign_in_policy_id == policy.id
+
+            policy.archived_at = Time.current
+            save!(policy)
+
+            audit!(Masks::Server::Event::SIGN_IN_POLICY_ARCHIVED, policy: policy.key, name: policy.name,
+                                                     clients: policy.clients.count)
+
+            { sign_in_policy: policy }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/base_mutation.rb

@@ -0,0 +1,139 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class BaseMutation < GraphQL::Schema::Mutation
+          class_attribute :level, instance_accessor: false, default: :owner
+          class_attribute :level_declared, instance_accessor: false, default: false
+
+          def self.requires(level)
+            raise ArgumentError, "no manage level called #{level}" unless ManageRoles::LEVELS.key?(level)
+
+            self.level = level
+            self.level_declared = true
+          end
+
+          def authorized?(**arguments)
+            return super if ManageRoles.permits?(roles, self.class.level)
+
+            refuse!("#{field.name} needs #{ManageRoles::LEVELS.fetch(self.class.level).join(' or ')}")
+          end
+
+          private
+
+            def roles
+              context[:roles] || []
+            end
+
+            def owner?
+              ManageRoles.owner?(roles)
+            end
+
+            def needs!(level, doing)
+              return if ManageRoles.permits?(roles, level)
+
+              refuse!("#{doing} needs #{ManageRoles::LEVELS.fetch(level).join(' or ')}")
+            end
+
+            def managed!(actor)
+              return actor if owner? || actor.id == viewer.id || !actor.manages?
+
+              refuse!("only an owner can change another manager")
+            end
+
+            def granting!(scopes)
+              return if owner?
+
+              held = ManageRoles.owner_only(scopes)
+
+              refuse!("only an owner can hand out #{Scopes.join(held)}") if held.any?
+            end
+
+            def viewer
+              context[:actor]
+            end
+
+            def refuse!(message)
+              raise GraphQL::ExecutionError, message
+            end
+
+            def audit!(action, actor: nil, client: nil, **details)
+              Masks::Server::Event.record!(action, actor: actor, by: viewer, client: client, **details)
+            end
+
+            def actor!(uuid)
+              managed!(Actor.find_by(uuid: uuid) || refuse!("no actor with that uuid"))
+            end
+
+            def client!(client_id)
+              client = Client.find_by(client_id: client_id) || refuse!("no client with that client_id")
+
+              if !owner? && ManageRoles.owner_only(Scopes.union(client.allowed_scopes, client.required_scopes)).any?
+                refuse!("only an owner can change a client that can carry a manage or provisioning scope")
+              end
+
+              client
+            end
+
+            def device!(id)
+              device = Masks::Server::Device.find_by(id: id) || refuse!("no device with that id")
+
+              return device if owner?
+
+              others = Masks::Server::Session.live.where(device: device).where.not(actor_id: viewer.id).includes(:actor)
+              refuse!("only an owner can act on a device another manager is signed in on") if others.any? { |held| held.actor.manages? }
+
+              device
+            end
+
+            def provider!(key)
+              Masks::Server::Provider.find_by(key: key) || refuse!("no provider keyed #{key}")
+            end
+
+            def sign_in_policy!(key)
+              Masks::Server::SignInPolicy.find_by(key: key) || refuse!("no sign-in policy keyed #{key}")
+            end
+
+            def sender!(key)
+              Masks::Server::Sender.find_by(key: key) || refuse!("no sender keyed #{key}")
+            end
+
+            def group!(key)
+              Masks::Server::Group.find_by(key: key) || refuse!("no group keyed #{key}")
+            end
+
+            def invited!(actor)
+              actor_created!(actor, invited: true)
+
+              Masks::Server::Invitations.open(actor: actor, journey: Masks::Server::Journey.manage(viewer))
+            end
+
+            def actor_created!(actor, invited:)
+              audit!(Masks::Server::Event::ACTOR_CREATED, actor: actor, nickname: actor.nickname,
+                                                          scopes: actor.scope_list, invited: invited)
+            end
+
+            def event_stream!(key)
+              Masks::Server::EventStream.find_by(key: key) || refuse!("no event stream keyed #{key}")
+            end
+
+            def organization_named(key)
+              return nil if key.blank?
+
+              Masks::Server::Organization.find_by(key: key) || refuse!("no organization keyed #{key}")
+            end
+
+            def signing_key!(kid)
+              Masks::Server::SigningKey.find_by(kid: kid) || refuse!("no signing key with that kid")
+            end
+
+            def save!(record)
+              refuse!(record.errors.full_messages.join("; ")) unless record.save
+
+              record
+            end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/block_device.rb

@@ -0,0 +1,24 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class BlockDevice < BaseMutation
+          requires :support
+
+          argument :id, ID
+
+          field :device, Types::DeviceType, null: false
+
+          def resolve(id:)
+            device = device!(id)
+
+            device.block!
+            audit!(Masks::Server::Event::DEVICE_BLOCKED, device: device)
+
+            { device: device }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/block_devices.rb

@@ -0,0 +1,62 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class BlockDevices < BaseMutation
+          requires :security
+
+          MOST = 500
+
+          argument :ids, [ ID ], required: false
+          argument :agent, String, required: false
+          argument :refuse, Boolean, required: false
+
+          field :count, Integer, null: false
+          field :spared, Boolean, null: false
+
+          def resolve(ids: nil, agent: nil, refuse: false)
+            agent = agent&.strip.presence
+
+            refuse!("name devices by ids or by agent, not both") if ids && agent
+            refuse!("name devices by ids or by agent") if ids.nil? && agent.nil?
+            refuse!("at most #{MOST} devices at once") if ids && ids.size > MOST
+            refuse!("refusing an agent needs the agent") if refuse && agent.nil?
+            refuse!("MASKS_BLOCKED_AGENTS pins the agents refused here") if refuse && Current.tenant.agents_pinned?
+
+            chosen = Masks::Server::Device.allowed
+            chosen = ids ? chosen.where(id: ids) : chosen.agent_like(agent)
+
+            own = context[:token]&.device_id
+            spared = own.present? && chosen.exists?(id: own)
+            chosen = chosen.where.not(id: own) if own
+
+            count = 0
+
+            ActiveRecord::Base.transaction do
+              chosen.find_each do |device|
+                device.block!
+                audit!(Masks::Server::Event::DEVICE_BLOCKED, device: device, **(agent ? { agent: agent } : {}))
+                count += 1
+              end
+
+              remember!(agent) if refuse
+            end
+
+            { count: count, spared: spared }
+          end
+
+          private
+
+            def remember!(agent)
+              tenant = Current.tenant
+
+              return if tenant.agent_list.include?(agent.downcase)
+
+              tenant.blocked_agents = [ tenant.blocked_agents.presence, agent ].compact.join("\n")
+              save!(tenant)
+            end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/check_domain.rb

@@ -0,0 +1,30 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class CheckDomain < DomainMutation
+          requires :security
+
+          description "Looks up a claim's TXT record now, instead of waiting for the hourly check."
+
+          argument :domain, String
+
+          field :domain_claim, Types::DomainClaimType, null: false
+          field :found, Boolean, null: false
+
+          def resolve(domain:)
+            claim = claim!(domain)
+            was = claim.verified?
+            found = claim.check!
+
+            audit!(Masks::Server::Event::DOMAIN_VERIFIED, domain: claim.domain) if claim.verified? && !was
+
+            { domain_claim: claim, found: found }
+          rescue Masks::Server::DomainClaim::Taken => e
+            refuse!(e.message)
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/claim_domain.rb

@@ -0,0 +1,26 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class ClaimDomain < DomainMutation
+          requires :security
+
+          description "Starts claiming a domain. Publish the TXT record it returns, then check it."
+
+          argument :domain, String
+          argument :provider, ID, required: false, description: "The provider to send people with an address here to."
+
+          field :domain_claim, Types::DomainClaimType, null: false
+
+          def resolve(domain:, provider: nil)
+            claim = save!(Masks::Server::DomainClaim.new(domain: domain, provider: signing_provider!(provider)))
+
+            audit!(Masks::Server::Event::DOMAIN_CLAIMED, domain: claim.domain, provider: claim.provider&.key)
+
+            { domain_claim: claim }
+          end
+        end
+      end
+    end
+  end
+end