masks-server 0.8.0 → 0.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '0815510a0ee659d9ba2cf35bb8840d7a3a7b7abb7306e0e0cf3f64fd7890d7dd'
-  data.tar.gz: 188b4436824c6f113da49a7880ad15d6f4d0c915f5c5df9b94ba7affcb51fca8
+  metadata.gz: 544dc01d0600507eb713667f0d8cf57275b4b7d957b603e3085f9e197e7e63c6
+  data.tar.gz: 70f664c959b40e98e9a273582a45c0dba352e5186430a72c26e3a8dd87db978b
 SHA512:
-  metadata.gz: faeda2a8132f3e2e92ce8a1f41d235cae52f0640ad33ed3220d526619c5ecd113fece66af5923cb8e610564399ba3db0f22bdd16e9e0306d0155ba63f9e13f91
-  data.tar.gz: bef27fdefa6bc7d1f88a386ac23261cad8b487137ea8130c0bfa41467f7bbec11b59058386ceb0fabe0f97cca1a914a1a3a9aaef6c74a48478b266e3a9c62858
+  metadata.gz: a5c6177ca713658c3003f33cea0b8902c6810266271f4d4e6d0215d8a291b6da13a47add90dca3b65df3f9614f6161dd5627853c3e9038ddafffcc0963ce27d4
+  data.tar.gz: 872c0d7ce2bd4090f885fdbce3eb82d8459ff73840ac89d3bd9cd2088ae334dc1efb2c34fe7bc17a2f413492d07c15c74a69f73b771f98847a4a69ae10416228

data/app/controllers/concerns/masks/server/client_authentication.rb

@@ -16,9 +16,10 @@ module Masks
           client_refused!("no client is registered with that client_id") if client.nil?
           client_refused!("this client authenticates with a signed assertion, not a secret") if client.asserts?
 
-          client_refused! unless client.authenticate_secret(secret)
+          return client if client.authenticate_secret(secret)
 
-          client
+          client_refused!("this client's secret expired on #{client.secret_expires_at.iso8601}, and a manager rotates it") if client.secret_expired? && client.secret_matches?(secret)
+          client_refused!
         end
 
         def asserted_client(assertion)
@@ -44,7 +45,7 @@ module Masks
         end
 
         def assertion_audiences
-          [ issuer.url, "#{issuer.url}/token", "#{issuer.url}#{request.path}" ].uniq
+          [ issuer.url, "#{issuer.url}/token", "#{issuer.url}#{request.path_info}" ].uniq
         end
 
         def presented_credentials

data/app/controllers/concerns/masks/server/resource_token.rb

@@ -19,7 +19,7 @@ module Masks
           answer = handler.call(request.env)
 
           return render_rack(answer) unless answer.first == 200
-          return refuse_token("a bearer token is required") if token.nil?
+          return ask_for_token if token.nil?
 
           yield token
         end
@@ -50,8 +50,11 @@ module Masks
 
         def decode(bearer)
           claims_in_token(bearer.access_token)
+        rescue JWT::ExpiredSignature
+          bearer.invalid_token!("that token has expired")
         rescue JWT::DecodeError => e
-          bearer.invalid_token!(e.message)
+          ::Rails.logger.info("masks: an access token was refused: #{e.message}")
+          bearer.invalid_token!("that token is not one this server signed")
         end
 
         def claims_in_token(secret)
@@ -96,7 +99,7 @@ module Masks
         end
 
         def proof_for(secret = nil)
-          Proof.read!(request, url: "#{issuer.url}#{request.path}", access_token: secret)
+          Proof.read!(request, url: "#{issuer.url}#{request.path_info}", access_token: secret)
         end
 
         def held_token(secret)
@@ -118,6 +121,12 @@ module Masks
           nil
         end
 
+        def ask_for_token
+          response.headers["WWW-Authenticate"] = %(Bearer realm="#{issuer.url}")
+
+          head :unauthorized
+        end
+
         def refuse_token(description)
           render_rack(
             Rack::OAuth2::Server::Resource::Bearer::Unauthorized.new(

data/app/controllers/masks/server/addresses_controller.rb

@@ -8,6 +8,7 @@ module Masks
                  only: :update
 
       before_action :require_actor
+      before_action :known_channel
       before_action -> { reauthenticated!(anchor, t("addresses.again")) }
       before_action :refuse_directed
 
@@ -55,7 +56,11 @@ module Masks
       private
 
         def channel
-          params[:channel].to_s
+          @channel ||= Addresses::CHANNELS.keys.find { |known| known == params[:channel].to_s }
+        end
+
+        def known_channel
+          head :not_found if channel.nil?
         end
 
         def anchor

data/app/controllers/masks/server/application_controller.rb

@@ -143,7 +143,7 @@ module Masks
           Current.device = device
         end
 
-        def sign_in(actor, amr: [], policy: nil, first_factor: {})
+        def sign_in(actor, amr: [], policy: nil, first_factor: {}, authenticated_at: nil)
           carried = session.to_hash.slice(REQUESTS, HANDSHAKES, "login", RETURN_TO)
           reset_session
           carried.each { |key, value| session[key] = value }
@@ -157,7 +157,8 @@ module Masks
             ip_address: request.remote_ip,
             amr: amr,
             policy: policy,
-            first_factor: first_factor
+            first_factor: first_factor,
+            authenticated_at: authenticated_at
           )
 
           cookies.encrypted[:masks_session] = {
@@ -263,6 +264,34 @@ module Masks
           )
         end
 
+        def answerable?(pending)
+          authorization = pending.authorization
+
+          authorization.client&.approved? || ours?(authorization.redirect_uri)
+        end
+
+        def refuse_on_masks(pending, refusal)
+          pending.refuse!(refusal.error, refusal.description)
+          PendingRequest.claim(rid_for(pending))
+
+          authorize_refused_path(rid: rid_for(pending))
+        end
+
+        def refused_request(rid)
+          return nil if rid.blank? || !tracked(REQUESTS).value?(rid)
+
+          PendingRequest.spent(rid)&.then { |held| held if held.consumed? }
+        end
+
+        def ours?(target)
+          here = URI.parse(issuer.url)
+          there = URI.parse(target.to_s)
+
+          there.scheme == here.scheme && there.host == here.host && there.port == here.port
+        rescue URI::InvalidURIError
+          false
+        end
+
         def authorize_url_for(pending)
           "#{authorize_path}?#{URI.encode_www_form(pending.authorization.query_pairs)}"
         end
@@ -301,17 +330,18 @@ module Masks
         end
 
         def settle!(login)
-          hold(login.actor, amr: login.amr, policy: login.policy, first_factor: login.first_factored_by)
+          hold(login.actor, amr: login.amr, policy: login.policy, first_factor: login.first_factored_by,
+                            authenticated_at: login.authenticated_at)
           forget_login
         end
 
-        def hold(actor, amr: [], policy: nil, first_factor: {})
+        def hold(actor, amr: [], policy: nil, first_factor: {}, authenticated_at: nil)
           return if actor.nil?
-          return current_session.first_factored!(first_factor) if current_session&.actor_id == actor.id
+          return current_session.first_factored!(first_factor, at: authenticated_at) if current_session&.actor_id == actor.id
 
           sign_out if current_session
 
-          sign_in(actor, amr: amr, policy: policy, first_factor: first_factor)
+          sign_in(actor, amr: amr, policy: policy, first_factor: first_factor, authenticated_at: authenticated_at)
         end
 
         def policy_denied(denial)

data/app/controllers/masks/server/authorize_controller.rb

@@ -45,6 +45,7 @@ module Masks
 
         login = advance(pending)
 
+        return redirect_to(refuse_on_masks(pending, login.refusal)) if login.refused? && !answerable?(pending)
         return answer(deny(pending, login.refusal.error, login.refusal.description)) if login.refused?
         return interaction_required(pending) if login.prompted? && pending.silent?
         return redirect_to(login.redirect_to, allow_other_host: true) if login.redirect_to.present?
@@ -53,6 +54,15 @@ module Masks
         complete(pending, attempt, login)
       end
 
+      def refused
+        refusal = refused_request(params[:rid])&.refusal
+
+        return show_error("invalid_request", "that sign-in request has expired", :bad_request) if refusal.nil?
+
+        @refused = true
+        show_error(refusal["error"], refusal["description"], :forbidden)
+      end
+
       private
 
         def validate(authorization)
@@ -63,9 +73,10 @@ module Masks
             req.bad_request!(:invalid_client, unknown_client(req.client_id)) if client.nil?
             req.invalid_request!("redirect_uri is required") if req.redirect_uri.blank?
 
-            req.verify_redirect_uri!(client.redirect_uris)
+            req.verify_redirect_uri!(client.redirect_uri?(req.redirect_uri) ? [ req.redirect_uri.to_s ] : client.redirect_uris)
             req.verified_redirect_uri = with_issuer(req.verified_redirect_uri)
             res.redirect_uri = req.verified_redirect_uri
+            req.verified_redirect_uri = nil unless hears_errors?(client, req.redirect_uri)
 
             permit(req) { authorization.validate! }
           end
@@ -97,7 +108,7 @@ module Masks
             actor: current_actor,
             device: current_device,
             session: current_session,
-            authenticated_at: login.authenticated_at || current_session&.authenticated_at,
+            authenticated_at: current_session&.authenticated_at,
             amr: login.amr.presence || current_session&.amr,
             organization: login.state("organization-choice").selected
           )
@@ -121,21 +132,20 @@ module Masks
           client = Client.authenticating(params[:client_id])
           target = params[:redirect_uri].to_s
 
-          if target.present? && (client&.redirect_uri?(target) || ours?(target))
+          if target.present? && hears_errors?(client, target)
             return redirect_to refusal_uri(target, error), allow_other_host: true
           end
 
-          @error_code = error.error.to_s
-          @error_description = error.description
+          show_error(error.error.to_s, error.description, error.status)
+        end
+
+        def show_error(code, description, status)
+          @error_code = code
+          @error_description = description
 
           respond_to do |format|
-            format.html { render :error, status: error.status }
-            format.any do
-              render json: {
-                "error" => @error_code,
-                "error_description" => @error_description
-              }, status: error.status
-            end
+            format.html { render :error, status: status }
+            format.any { render json: { "error" => code, "error_description" => description }, status: status }
           end
         end
 
@@ -163,13 +173,8 @@ module Masks
           Rack::OAuth2::Server::Authorize::BadRequest.new(error, description)
         end
 
-        def ours?(target)
-          here = URI.parse(issuer.url)
-          there = URI.parse(target.to_s)
-
-          there.scheme == here.scheme && there.host == here.host && there.port == here.port
-        rescue URI::InvalidURIError
-          false
+        def hears_errors?(client, target)
+          ours?(target) || (client.present? && client.approved? && client.redirect_uri?(target))
         end
 
         def refusal_uri(target, error)

data/app/controllers/masks/server/device_verifications_controller.rb

@@ -59,7 +59,7 @@ module Masks
             actor: current_actor,
             session: current_session,
             device: current_device,
-            authenticated_at: login.authenticated_at || current_session&.authenticated_at,
+            authenticated_at: current_session&.authenticated_at,
             amr: login.amr.presence || current_session&.amr,
             organization: login.state("organization-choice").selected
           )

data/app/controllers/masks/server/logins_controller.rb

@@ -151,7 +151,8 @@ module Masks
           return unless login.actor
 
           if login.touched?(:first_factor)
-            sign_in(login.actor, amr: login.amr, policy: login.policy, first_factor: login.first_factored_by)
+            sign_in(login.actor, amr: login.amr, policy: login.policy, first_factor: login.first_factored_by,
+                                 authenticated_at: login.authenticated_at)
           elsif login.signed_in? && login.touched?(:second_factor)
             current_session.update!(amr: Array(current_session.amr) | login.amr)
           end
@@ -190,6 +191,7 @@ module Masks
           return refuse_device(pending) if login.refused? && pending&.device?
           return refuse_saml(pending) if login.refused? && pending&.saml?
           return saml_resume_path(rid: rid_for(pending)) if pending&.saml?
+          return refuse_on_masks(pending, login.refusal) if login.refused? && pending && !answerable?(pending)
           return deny(pending, login.refusal.error, login.refusal.description) if login.refused? && pending
           return device_url_for(pending) if pending&.device?
           return authorize_url_for(pending) if pending

data/app/controllers/masks/server/notifications_controller.rb

@@ -2,9 +2,19 @@ module Masks
   module Server
     class NotificationsController < ApplicationController
       before_action :require_actor
+      before_action -> { reauthenticated!("notifications", t("notifications.again")) }
 
       def update
+        was = current_actor.muted_notifications
         current_actor.update!(notifications: wanted)
+        now = current_actor.muted_notifications
+
+        muted = now - was
+        unmuted = was - now
+
+        if muted.any? || unmuted.any?
+          Event.record!(Event::NOTIFICATIONS_CHANGED, actor: current_actor, muted: muted, unmuted: unmuted)
+        end
 
         redirect_to "#{root_path}#notifications", notice: t("notifications.saved")
       end
@@ -12,7 +22,7 @@ module Masks
       private
 
         def wanted
-          Array(params[:notifications]).map(&:to_s) & Notifications::MAILED
+          Array(params[:notifications]).map(&:to_s) & Notifications::MUTABLE
         end
 
         def require_actor

data/app/controllers/masks/server/profiles_controller.rb

@@ -5,6 +5,7 @@ module Masks
 
       def update
         return refuse(t("profiles.directed")) if current_actor.directed?
+        return unless kept_nickname? || reauthenticated!("profile", t("profiles.again"))
 
         current_actor.assign_attributes(profile)
         changed = current_actor.changed
@@ -22,6 +23,10 @@ module Masks
           params.permit(:name, :nickname).to_h.transform_values { |value| value.strip.presence }
         end
 
+        def kept_nickname?
+          !profile.key?("nickname") || profile["nickname"] == current_actor.nickname
+        end
+
         def require_actor
           redirect_to login_path unless current_actor
         end

data/app/controllers/masks/server/registrations_controller.rb

@@ -133,6 +133,12 @@ module Masks
           }, status: :bad_request
         end
 
+        def ask_for_token
+          response.headers["WWW-Authenticate"] = %(Bearer realm="#{issuer.url}")
+
+          head :unauthorized
+        end
+
         def issued(client)
           client.metadata.merge(
             "client_secret" => client.secret,
@@ -155,7 +161,9 @@ module Masks
         end
 
         def unauthorized(description)
-          response.headers["WWW-Authenticate"] = %(Bearer error="invalid_token")
+          return ask_for_token if bearer.blank?
+
+          response.headers["WWW-Authenticate"] = %(Bearer realm="#{issuer.url}", error="invalid_token")
 
           render json: {
             "error" => "invalid_token",

data/app/controllers/masks/server/saml_controller.rb

@@ -139,7 +139,7 @@ module Masks
           assertion = response_for(pending)
           encoded = assertion.success(
             actor: current_actor, session: current_session, name_id_format: saml["name_id_format"], scopes: scopes,
-            authenticated_at: login.authenticated_at || current_session&.authenticated_at,
+            authenticated_at: current_session&.authenticated_at,
             amr: login.amr.presence || current_session&.amr
           )
 
@@ -174,12 +174,6 @@ module Masks
           )
         end
 
-        def refused_request(rid)
-          return nil if rid.blank? || !tracked(REQUESTS).value?(rid)
-
-          PendingRequest.spent(rid)&.then { |held| held if held.consumed? }
-        end
-
         def post(pending, encoded)
           post_saml(pending.client, pending.redirect_uri, "SAMLResponse", encoded, relay_state: pending.held("saml")["relay_state"])
         end

data/app/controllers/masks/server/scim/metadata_controller.rb

@@ -7,7 +7,7 @@ module Masks
         def service_provider_config
           scim({
             "schemas" => [ Scim::SERVICE_PROVIDER_CONFIG ],
-            "documentationUri" => "#{::Rails.configuration.masks.docs_url}/concepts/provisioning/",
+            "documentationUri" => "#{::Rails.configuration.masks.docs_url}/guides/sso-saml/#provisioning",
             "patch" => { "supported" => true },
             "bulk" => { "supported" => false, "maxOperations" => 0, "maxPayloadSize" => 0 },
             "filter" => { "supported" => true, "maxResults" => Scim::MAX_RESULTS },

data/app/controllers/masks/server/tokens_controller.rb

@@ -42,7 +42,7 @@ module Masks
           return @proof if defined?(@proof)
 
           @proof = if Proof.presented?(request)
-            Proof.read!(request, url: "#{issuer.url}#{request.path}")
+            Proof.read!(request, url: "#{issuer.url}#{request.path_info}")
           end
         end
 
@@ -124,6 +124,7 @@ module Masks
 
           req.invalid_grant!("that refresh token was issued to another client") if token.client_id != client.id
           req.invalid_grant!("the session that refresh token was issued in has ended") if outlived?(token)
+          exhausted!(req, token, client)
           member!(req, token)
           consented!(req, token, client)
           Current.organization = token.organization
@@ -180,6 +181,13 @@ module Masks
           held.present? && held.bounded? && !held.live?
         end
 
+        def exhausted!(req, token, client)
+          return unless token.exhausted?(client.refresh_absolute_lifetime)
+
+          token.revoke_family!
+          req.invalid_grant!("the sign-in behind that refresh token is older than #{client.name} allows")
+        end
+
         def replayed!(spent, client)
           return if spent.nil? || !spent.consumed?
 

data/app/graphql/masks/server/manage/mutations/add_app.rb

@@ -7,7 +7,7 @@ module Masks
 
           argument :preset, ID
           argument :base_url, String, description: "Where the app is served, such as https://grafana.example.com."
-          argument :name, String, required: false, description: "What people see. The preset's name when left out."
+          argument :name, String, required: false, description: "What people see."
           argument :slug, String, required: false,
                    description: "The name some apps put in their redirect URI, such as Gitea's authentication source."
 

data/app/graphql/masks/server/manage/mutations/create_actor.rb

@@ -18,6 +18,7 @@ module Masks
             granting!(scopes)
 
             actor = Actor.new(
+              trusted_rename: true,
               nickname: nickname,
               email: email,
               scopes: Scopes.join(Scopes.list(scopes).presence || Scopes::STANDARD)

data/app/graphql/masks/server/manage/mutations/update_actor.rb

@@ -29,6 +29,7 @@ module Masks
             needs!(:security, "changing someone's email address") if changing_email
             previous = actor.email if changing_email && actor.email_verified_at.present?
 
+            actor.trusted_rename = true
             actor.assign_attributes(attributes)
             actor.email_verified_at = nil if changing_email
             actor.phone_verified_at = nil if attributes.key?(:phone) && actor.phone_changed?

data/app/graphql/masks/server/manage/mutations/update_client.rb

@@ -36,6 +36,9 @@ module Masks
                    description: "Seconds an access token lasts, from 60 to a day. Zero goes back to an hour."
           argument :refresh_token_lifetime, Integer, required: false,
                    description: "Seconds a refresh token lasts unused, from 300 to 400 days. Zero goes back to 30 days."
+          argument :refresh_token_absolute_lifetime, Integer, required: false,
+                   description: "Seconds from a sign-in until its refresh tokens stop, however often they are used, " \
+                                "from 300 to 400 days. Zero goes back to 90 days."
           argument :allowed_groups, [ String ], required: false,
                    description: "Group keys, or organization roles as key:role, whose people may sign in to this client. Empty lets everyone in."
           argument :sign_in_policy, ID, required: false
@@ -68,6 +71,7 @@ module Masks
             attributes[:consent_lifetime] = nil if attributes[:consent_lifetime]&.zero?
             attributes[:access_token_lifetime] = nil if attributes[:access_token_lifetime]&.zero?
             attributes[:refresh_token_lifetime] = nil if attributes[:refresh_token_lifetime]&.zero?
+            attributes[:refresh_token_absolute_lifetime] = nil if attributes[:refresh_token_absolute_lifetime]&.zero?
             client.assign_attributes(attributes)
             client.response_types = client.default_response_types if attributes.key?(:grant_types)
             client.required_scopes = Scopes.join(required_scopes) unless required_scopes.nil?

data/app/graphql/masks/server/manage/types/client_type.rb

@@ -16,6 +16,8 @@ module Masks
                 description: "Seconds an access token lasts. Null is an hour."
           field :refresh_token_lifetime, Integer,
                 description: "Seconds a refresh token lasts unused. Each refresh starts it over. Null is 30 days."
+          field :refresh_token_absolute_lifetime, Integer,
+                description: "Seconds from a sign-in until its refresh tokens stop, however often they are used. Null is 90 days."
           field :allowed_groups, [ String ], null: false,
                 description: "Group keys, or organization roles as key:role, whose people may sign in. Empty lets everyone in."
           field :namespaces, [ "Masks::Server::Manage::Types::NamespaceType" ], null: false

data/app/graphql/masks/server/manage/types/query_type.rb

@@ -139,6 +139,9 @@ module Masks
           field :ldap_base_dn, String, null: false, description: "The base DN of this tenant's LDAP directory."
           field :ldap_port, Integer, null: false, description: "The port masks serves LDAP on."
           field :ldap_tls, Boolean, null: false, description: "Whether that port speaks LDAPS."
+          field :ldap_local_only, Boolean, null: false,
+                description: "Whether the directory answers only on the server's own machine, " \
+                             "since it has no certificate and MASKS_LDAP_PLAINTEXT is not set."
           field :saml_metadata_url, String, null: false
 
           field :minimum_password, Integer, null: false
@@ -236,6 +239,10 @@ module Masks
             ::Rails.configuration.masks.ldap_cert.present?
           end
 
+          def ldap_local_only
+            Ldap::Listener.local_only?
+          end
+
           def ldap_base_dn
             Ldap::Directory.base_for(Current.tenant).to_s
           end

data/app/helpers/masks/server/account_helper.rb

@@ -15,7 +15,7 @@ module Masks
         close: '<path d="M6.5 6.5l7 7M13.5 6.5l-7 7"/>',
         check: '<path d="m5.5 10.5 3 3 6-7"/>',
         organization: '<rect x="3.5" y="7" width="13" height="9.5" rx="1.5"/><path d="M7.5 7V4.5h5V7"/><path d="M3.5 11h13"/>',
-        person: '<circle cx="10" cy="7" r="3.25"/><path d="M4 16.5c.8-3 3.2-4.5 6-4.5s5.2 1.5 6 4.5"/>',
+        actor: '<circle cx="10" cy="7" r="3.25"/><path d="M4 16.5c.8-3 3.2-4.5 6-4.5s5.2 1.5 6 4.5"/>',
         authenticator: '<rect x="3" y="5.5" width="14" height="9" rx="2"/><path d="M6.5 10h.01M10 10h.01M13.5 10h.01"/>',
         backup_codes: '<path d="M5.5 3.5h9v13h-9z"/><path d="M8 7h4M8 10h4M8 13h4"/>',
         manage: '<path d="M10 2.5 3.5 5v5c0 3.4 2.7 6.2 6.5 7.5 3.8-1.3 6.5-4.1 6.5-7.5V5L10 2.5Z"/>'

data/app/jobs/masks/server/cleanup_job.rb

@@ -33,6 +33,7 @@ module Masks
           Event.where(created_at: ...tenant.event_retention.ago).in_batches(of: BATCH).delete_all
           Members.purge_lapsed!
           Replay.where(expires_at: ...Time.current).in_batches(of: BATCH).delete_all
+          ReleasedNickname.lapsed.in_batches(of: BATCH).delete_all
         end
 
         def sweep_tokens(cutoff)

data/app/ldap/masks/server/ldap/listener.rb

@@ -6,11 +6,24 @@ module Masks
         IDLE = 5.minutes
         HANDSHAKE = 10.seconds
 
-        attr_reader :port
+        EVERY_ADDRESS = "0.0.0.0".freeze
+        THIS_MACHINE = "127.0.0.1".freeze
+
+        attr_reader :host, :port
 
         class << self
           def from_configuration(config = ::Rails.configuration.masks)
-            new(host: "0.0.0.0", port: config.ldap_port, tls: tls(config.ldap_cert, config.ldap_key))
+            tls = tls(config.ldap_cert, config.ldap_key)
+
+            new(host: host_for(tls: tls, plaintext: config.ldap_plaintext), port: config.ldap_port, tls: tls)
+          end
+
+          def host_for(tls:, plaintext:)
+            tls || plaintext ? EVERY_ADDRESS : THIS_MACHINE
+          end
+
+          def local_only?(config = ::Rails.configuration.masks)
+            config.ldap_cert.blank? && !config.ldap_plaintext
           end
 
           def tls(cert, key)
@@ -40,7 +53,7 @@ module Masks
         def start
           @server = TCPServer.new(@host, @wanted_port)
           @port = @server.local_address.ip_port
-          @logger.info("masks ldap: listening on #{@host}:#{@port}#{' with TLS' if @tls}")
+          @logger.info("masks ldap: listening on #{@host}:#{@port}#{' with TLS' if @tls}#{' on this machine only' if @host == THIS_MACHINE}")
           @acceptor = Thread.new { accept_loop }
           self
         end

data/app/logins/masks/server/login_states/confirmation.rb

@@ -23,11 +23,11 @@ module Masks
           resend
         end
 
-        handles "confirm:add-phone" do
+        handles "confirm:add-phone", limit: :sending do
           add_phone
         end
 
-        handles "confirm:change-phone" do
+        handles "confirm:change-phone", limit: :sending do
           change_phone
         end
 
@@ -129,9 +129,15 @@ module Masks
           end
 
           def send_code(channel)
+            @tokens&.delete(channel)
+
+            if ConfirmationCode.crowded?(actor: actor, channel: channel)
+              login.store[HELD] = held.merge("#{channel}_sent" => Time.current.to_i)
+              return warn!(channel == ConfirmationCode::PHONE ? "too-many-texts" : "too-many-codes")
+            end
+
             token = Confirmations.send_code(actor, channel, journey: Masks::Server::Journey.sign_in(login))
 
-            @tokens&.delete(channel)
             login.store[HELD] = held.merge(channel => token.id, "#{channel}_sent" => Time.current.to_i)
           end
 

data/app/logins/masks/server/login_states/signup.rb

@@ -280,6 +280,7 @@ module Masks
 
               now = Time.current
               actor = Masks::Server::Actor.new(
+                trusted_rename: @first_run,
                 nickname: held["nickname"],
                 email: held["email"],
                 name: held["name"],