masks-server 0.7.0

data/app/graphql/masks/server/manage/mutations/create_actor.rb

@@ -0,0 +1,50 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class CreateActor < BaseMutation
+          requires :support
+
+          argument :nickname, String, required: false
+          argument :email, String, required: false
+          argument :password, String, required: false
+          argument :scopes, [ String ], required: false
+
+          field :actor, Types::ActorType, null: false
+          field :delivered, Boolean, null: false
+          field :url, String
+
+          def resolve(nickname: nil, email: nil, password: nil, scopes: nil)
+            granting!(scopes)
+
+            actor = Actor.new(
+              nickname: nickname,
+              email: email,
+              scopes: Scopes.join(Scopes.list(scopes).presence || Scopes::STANDARD)
+            )
+
+            return invite(actor) if password.blank?
+
+            if password.length < Actor::MINIMUM_PASSWORD
+              refuse!("a password needs at least #{Actor::MINIMUM_PASSWORD} characters")
+            end
+
+            actor.password = password
+            save!(actor)
+            actor_created!(actor, invited: false)
+
+            Verifications.open(actor: actor, journey: Masks::Server::Journey.manage(viewer)).merge(actor: actor)
+          end
+
+          private
+
+            def invite(actor)
+              save!(actor)
+
+              invited!(actor).merge(actor: actor)
+            end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/create_client.rb

@@ -0,0 +1,53 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class CreateClient < BaseMutation
+          requires :security
+
+          argument :name, String
+          argument :grant_types, [ String ], required: false
+          argument :redirect_uris, [ String ], required: false
+          argument :post_logout_redirect_uris, [ String ], required: false
+          argument :resources, [ String ], required: false
+          argument :required_scopes, [ String ], required: false
+          argument :allowed_scopes, [ String ], required: false
+          argument :token_endpoint_auth_method, String, required: false
+          argument :dpop_bound_access_tokens, Boolean, required: false
+          argument :jwks, GraphQL::Types::JSON, required: false
+          argument :jwks_uri, String, required: false
+          argument :require_signed_request_object, Boolean, required: false
+
+          field :client, Types::ClientType, null: false
+          field :secret, String
+
+          def resolve(name:, grant_types: [ Masks::Server::Client::CLIENT_CREDENTIALS ], required_scopes: [], allowed_scopes: [],
+                      token_endpoint_auth_method: Masks::Server::Client::DEFAULT_AUTH_METHOD, **attributes)
+            granting!(Scopes.union(required_scopes, allowed_scopes))
+
+            client = Masks::Server::Client.new(
+              client_id: SecureRandom.uuid,
+              name: name,
+              grant_types: grant_types,
+              response_types: Masks::Server::Client.response_types_for(grant_types),
+              required_scopes: Scopes.join(required_scopes),
+              allowed_scopes: Scopes.join(allowed_scopes),
+              token_endpoint_auth_method: token_endpoint_auth_method,
+              dynamic: false,
+              approved_at: Time.current,
+              approved_by: viewer,
+              **attributes.compact
+            )
+
+            client.issue_secret! if client.secret?
+            save!(client)
+
+            audit!(Masks::Server::Event::CLIENT_CREATED, client: client, name: client.name, grant_types: client.grant_types)
+
+            { client: client, secret: client.secret }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/create_event_stream.rb

@@ -0,0 +1,33 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class CreateEventStream < BaseMutation
+          requires :security
+
+          argument :key, ID
+          argument :name, String
+          argument :url, String
+          argument :actions, [ String ], required: false
+          argument :organization, ID, required: false, description: "An organization's key, to send only its events. An empty string sends every event."
+
+          field :event_stream, Types::EventStreamType, null: false
+          field :secret, String, null: false
+
+          def resolve(key:, name:, url:, actions: nil, organization: nil)
+            refuse!("an event stream is already keyed #{key}") if Masks::Server::EventStream.exists?(key: key)
+
+            stream = Masks::Server::EventStream.new(key: key, name: name, url: url, actions: actions || [],
+                                                    organization: organization_named(organization))
+
+            save!(stream)
+
+            audit!(Masks::Server::Event::STREAM_CREATED, stream: stream.key)
+
+            { event_stream: stream, secret: stream.secret }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/create_group.rb

@@ -0,0 +1,25 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class CreateGroup < BaseMutation
+          requires :security
+
+          argument :key, String, description: "Lowercase letters, digits, dots, dashes, and underscores. Apps see it in the groups claim."
+          argument :name, String
+
+          field :group, Types::GroupType, null: false
+
+          def resolve(key:, name:)
+            group = Masks::Server::Group.new(key: key, name: name)
+            save!(group)
+
+            audit!(Masks::Server::Event::GROUP_CREATED, group: group.key)
+
+            { group: group }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/create_organization.rb

@@ -0,0 +1,34 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class CreateOrganization < OrganizationMutation
+          requires :security
+
+          description "Creates an organization, owned by the person who creates it."
+
+          argument :key, ID
+          argument :name, String
+          argument :roles, [ String ], required: false, description: "Roles beyond owner and member."
+
+          field :organization, Types::OrganizationType, null: false
+
+          def resolve(key:, name:, roles: [])
+            refuse!("an organization is already keyed #{key}") if Masks::Server::Organization.exists?(key: key)
+
+            organization = Masks::Server::Organization.transaction do
+              save!(Masks::Server::Organization.new(key: key, name: name, roles: roles)).tap do |created|
+                audit!(Masks::Server::Event::ORGANIZATION_CREATED, organization: created.key)
+                Masks::Server::Members.enroll!(created, viewer, role: Masks::Server::Organization::OWNER, by: viewer)
+              end
+            end
+
+            { organization: organization }
+          rescue Masks::Server::Members::Refused => e
+            refuse!(e.message)
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/create_provider.rb

@@ -0,0 +1,117 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class CreateProvider < BaseMutation
+          requires :security
+
+          argument :key, ID
+          argument :name, String
+          argument :preset, ID, required: false
+          argument :preset_values, GraphQL::Types::JSON, required: false
+          argument :protocol, String, required: false
+          argument :authorization_url, String, required: false
+          argument :token_url, String, required: false
+          argument :client_id, String, required: false
+          argument :client_secret, String, required: false
+          argument :userinfo_url, String, required: false
+          argument :emails_url, String, required: false
+          argument :scopes, [ String ], required: false
+          argument :authorize_params, GraphQL::Types::JSON, required: false
+          argument :claims, GraphQL::Types::JSON, required: false
+          argument :subject_claim, String, required: false
+          argument :issuer, String, required: false
+          argument :jwks_uri, String, required: false
+          argument :token_auth_method, String, required: false
+          argument :response_mode, String, required: false
+          argument :team_id, String, required: false
+          argument :key_id, String, required: false
+          argument :private_key, String, required: false
+          argument :idp_entity_id, String, required: false
+          argument :idp_sso_url, String, required: false
+          argument :idp_certificates, String, required: false
+          argument :metadata_url, String, required: false
+          argument :name_id_format, String, required: false
+          argument :role, String, required: false
+          argument :trusts_email, Boolean, required: false
+          argument :receives_signals, Boolean, required: false,
+                   description: "Accepts the shared signals this provider sends to /ssf/events, and ends the sessions of the accounts they name."
+          argument :email_domains, [ String ], required: false
+          argument :signup_scopes, [ String ], required: false
+          argument :delegates, Boolean, required: false
+          argument :delegated_scopes, [ String ], required: false
+          argument :delegation_params, GraphQL::Types::JSON, required: false
+          argument :resource_url, String, required: false
+
+          field :provider, Types::ProviderType, null: false
+
+          def resolve(key:, preset: nil, preset_values: nil, scopes: nil, email_domains: nil, signup_scopes: nil,
+                      delegated_scopes: nil, **attributes)
+            refuse!("a provider is already keyed #{key}") if Masks::Server::Provider.exists?(key: key)
+
+            provider = Masks::Server::Provider.new(**preset_attributes(preset, preset_values), key: key)
+            provider.assign_attributes(attributes.compact)
+            provider.scopes = Scopes.join(scopes) if scopes
+            provider.email_domains = ProviderDomains.join(email_domains) if email_domains
+            provider.signup_scopes = Scopes.join(signup_scopes) if signup_scopes
+            provider.delegated_scopes = Scopes.join(delegated_scopes) if delegated_scopes
+
+            discover(provider)
+            read_metadata(provider)
+            register(provider)
+
+            save!(provider)
+            audit!(Masks::Server::Event::PROVIDER_CREATED, provider: provider.key, name: provider.name)
+
+            { provider: provider }
+          end
+
+          private
+
+            def preset_attributes(preset, values)
+              return {} if preset.blank?
+
+              found = Masks::Server::ProviderPreset.find(preset) || refuse!("there is no preset named #{preset}")
+
+              found.attributes(values.is_a?(Hash) ? values : {})
+            rescue Masks::Server::ProviderPreset::Unusable => e
+              refuse!(e.message)
+            end
+
+            def register(provider)
+              return unless provider.mcp? && provider.client_id.blank?
+
+              refuse!("an MCP server needs its URL") if provider.resource_url.blank?
+
+              provider.register!(callback: provider.callback_url)
+            rescue Masks::Server::Provider::Untrusted, Masks::Server::Provider::Refused, Masks::Server::Provider::Unreachable => e
+              refuse!(e.message)
+            end
+
+            def read_metadata(provider)
+              return unless provider.saml? && provider.metadata_url.present? && provider.idp_sso_url.blank?
+
+              provider.assign_attributes(Masks::Server::Federation::Saml.parse_metadata(provider.fetch_text(provider.metadata_url, Masks::Server::Federation::Saml::METADATA_LIMIT)))
+              provider.metadata_fetched_at = Time.current
+            rescue Masks::Server::Provider::Untrusted, Masks::Server::Provider::Refused, Masks::Server::Provider::Unreachable => e
+              refuse!(e.message)
+            end
+
+            def discover(provider)
+              return unless provider.oidc? && provider.issuer.present?
+              return if provider.authorization_url.present? && provider.token_url.present?
+
+              document = Masks::Server::Provider.discover(provider.issuer)
+
+              provider.authorization_url ||= document["authorization_endpoint"]
+              provider.token_url ||= document["token_endpoint"]
+              provider.userinfo_url ||= document["userinfo_endpoint"]
+              provider.jwks_uri ||= document["jwks_uri"]
+            rescue Masks::Server::Provider::Untrusted, Masks::Server::Provider::Refused, Masks::Server::Provider::Unreachable => e
+              refuse!(e.message)
+            end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/create_saml_application.rb

@@ -0,0 +1,53 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class CreateSamlApplication < BaseMutation
+          requires :security
+
+          argument :name, String
+          argument :entity_id, String
+          argument :acs_urls, [ String ]
+          argument :certificate, String, required: false
+          argument :name_id_format, String, required: false
+          argument :requests_signed, Boolean, required: false
+          argument :idp_initiated, Boolean, required: false
+          argument :attributes, GraphQL::Types::JSON, required: false
+          argument :slo_url, String, required: false,
+                   description: "The application's single logout URL, which receives masks' logout messages over HTTP-POST."
+
+          field :client, Types::ClientType, null: false
+
+          def resolve(name:, entity_id:, acs_urls:, certificate: nil, name_id_format: nil, requests_signed: false,
+                      idp_initiated: false, attributes: nil, slo_url: nil)
+            client = Masks::Server::Client.new(
+              client_id: SecureRandom.uuid,
+              name: name,
+              protocol: SamlIdentity::PROTOCOL,
+              saml_entity_id: entity_id,
+              redirect_uris: acs_urls.map(&:strip).compact_blank,
+              saml_certificate: certificate.presence,
+              saml_name_id_format: name_id_format.presence,
+              saml_requests_signed: requests_signed,
+              saml_idp_initiated: idp_initiated,
+              saml_attributes: attributes.presence || {},
+              saml_slo_url: slo_url.presence,
+              grant_types: [],
+              response_types: [],
+              token_endpoint_auth_method: "none",
+              allowed_scopes: Scopes.join(SamlIdentity::SCOPES),
+              dynamic: false,
+              approved_at: Time.current,
+              approved_by: viewer
+            )
+
+            save!(client)
+            audit!(Masks::Server::Event::CLIENT_CREATED, client: client, name: client.name, protocol: client.protocol)
+
+            { client: client }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/create_sender.rb

@@ -0,0 +1,35 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class CreateSender < BaseMutation
+          requires :security
+
+          argument :key, ID
+          argument :service, String
+          argument :name, String
+          argument :config, GraphQL::Types::JSON, required: false
+          argument :primary, Boolean, required: false
+
+          field :sender, Types::SenderType, null: false
+
+          def resolve(key:, service:, name:, config: nil, primary: nil)
+            klass = Masks::Server::Sender.service_for(service) || refuse!("there is no sender for #{service}")
+
+            refuse!("an sender is already keyed #{key}") if Masks::Server::Sender.exists?(key: key)
+
+            sender = klass.new(key: key, name: name)
+            sender.configure(config)
+            sender.primary = primary.nil? ? Masks::Server::Sender.primary(klass.kind).nil? : primary
+
+            save!(sender)
+
+            audit!(Masks::Server::Event::SENDER_CREATED, sender: sender.key, service: sender.service)
+
+            { sender: sender }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/create_sign_in_policy.rb

@@ -0,0 +1,24 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class CreateSignInPolicy < SignInPolicyMutation
+          requires :security
+
+          argument :key, ID
+
+          def resolve(key:, name: nil, **attributes)
+            refuse!("a sign-in policy is already keyed #{key}") if Masks::Server::SignInPolicy.exists?(key: key)
+
+            policy = apply(Masks::Server::SignInPolicy.new(key: key, name: name), **attributes)
+
+            save!(policy)
+            audit!(Masks::Server::Event::SIGN_IN_POLICY_CREATED, policy: policy.key, name: policy.name)
+
+            { sign_in_policy: policy }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/delete_actor.rb

@@ -0,0 +1,31 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class DeleteActor < BaseMutation
+          requires :owner
+
+          argument :uuid, ID
+
+          field :uuid, ID, null: false
+          field :identifier, String, null: false
+
+          def resolve(uuid:)
+            actor = actor!(uuid)
+
+            if actor.id == viewer.id
+              refuse!("that is you, and deleting yourself would lock you out")
+            end
+
+            held = { uuid: actor.uuid, identifier: actor.identifier }
+
+            actor.destroy!
+            audit!(Masks::Server::Event::ACTOR_DELETED, **held)
+
+            held
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/delete_group.rb

@@ -0,0 +1,24 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class DeleteGroup < BaseMutation
+          requires :security
+
+          argument :key, String
+
+          field :key, String, null: false
+
+          def resolve(key:)
+            group = group!(key)
+            group.destroy!
+
+            audit!(Masks::Server::Event::GROUP_DELETED, group: key)
+
+            { key: key }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/disable_authenticator.rb

@@ -0,0 +1,32 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class DisableAuthenticator < BaseMutation
+          requires :support
+
+          argument :uuid, ID
+
+          field :actor, Types::ActorType, null: false
+
+          def resolve(uuid:)
+            actor = actor!(uuid)
+
+            actor.assign_attributes(
+              otp_secret: nil,
+              otp_enabled_at: nil,
+              backup_code_digests: [],
+              backup_codes_generated_at: nil
+            )
+
+            save!(actor)
+            DeviceFactor.forget!(actor: actor)
+            audit!(Masks::Server::Event::AUTHENTICATOR_DISABLED, actor: actor)
+
+            { actor: actor }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/disable_code_factor.rb

@@ -0,0 +1,27 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class DisableCodeFactor < BaseMutation
+          requires :support
+
+          argument :uuid, ID
+          argument :factor, String
+
+          field :actor, Types::ActorType, null: false
+
+          def resolve(uuid:, factor:)
+            actor = actor!(uuid)
+
+            refuse!("factor must be email or sms") unless CodeFactors.known?(factor)
+            refuse!("that factor is not on") unless CodeFactors.disable!(actor, factor, by: viewer)
+
+            DeviceFactor.forget!(actor: actor)
+
+            { actor: actor }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/discard_signing_key.rb

@@ -0,0 +1,26 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class DiscardSigningKey < BaseMutation
+          requires :security
+
+          argument :kid, ID
+
+          field :kid, ID, null: false
+
+          def resolve(kid:)
+            key = signing_key!(kid)
+
+            refuse!("only a staged key may be discarded") unless key.staged?
+
+            key.destroy!
+            audit!(Masks::Server::Event::SIGNING_KEY_DISCARDED, kid: kid)
+
+            { kid: kid }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/discover_provider.rb

@@ -0,0 +1,39 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class DiscoverProvider < BaseMutation
+          requires :security
+
+          argument :issuer, String
+
+          field :issuer, String, null: false
+          field :authorization_url, String, null: false
+          field :token_url, String, null: false
+          field :userinfo_url, String
+          field :jwks_uri, String, null: false
+          field :scopes_supported, [ String ], null: false
+
+          def resolve(issuer:)
+            document = Masks::Server::Provider.discover(issuer)
+
+            missing = %w[authorization_endpoint token_endpoint jwks_uri].reject { |key| document[key].present? }
+
+            refuse!("#{issuer} publishes no #{missing.join(', ')}") if missing.any?
+
+            {
+              issuer: document["issuer"].to_s.chomp("/"),
+              authorization_url: document["authorization_endpoint"],
+              token_url: document["token_endpoint"],
+              userinfo_url: document["userinfo_endpoint"],
+              jwks_uri: document["jwks_uri"],
+              scopes_supported: Array(document["scopes_supported"])
+            }
+          rescue Masks::Server::Provider::Untrusted, Masks::Server::Provider::Refused, Masks::Server::Provider::Unreachable => e
+            refuse!(e.message)
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/dismiss_recovery.rb

@@ -0,0 +1,25 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class DismissRecovery < BaseMutation
+          requires :support
+
+          argument :uuid, ID
+
+          field :actor, Types::ActorType, null: false
+
+          def resolve(uuid:)
+            actor = actor!(uuid)
+
+            refuse!("#{actor.identifier} has not asked for help") if actor.recovery_requested_at.nil?
+
+            Masks::Server::HelpRequests.dismiss!(actor, by: viewer)
+
+            { actor: actor }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/domain_mutation.rb

@@ -0,0 +1,24 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class DomainMutation < BaseMutation
+          private
+
+            def claim!(domain)
+              Masks::Server::DomainClaim.find_by(domain: domain.to_s.strip.downcase) || refuse!("no claim on #{domain}")
+            end
+
+            def signing_provider!(key)
+              return nil if key.blank?
+
+              provider = provider!(key)
+              refuse!("#{provider.name} cannot sign anybody in") unless provider.signs_in?
+
+              provider
+            end
+        end
+      end
+    end
+  end
+end