masks-server 0.8.0 → 0.10.0

data/app/models/masks/server/actor.rb

@@ -33,6 +33,9 @@ module Masks
       has_many :groups, through: :group_members
 
       before_destroy :sign_out_everywhere!, prepend: true
+      before_destroy :release_nickname
+
+      attr_accessor :trusted_rename
 
       validates :nickname,
                 uniqueness: { scope: :tenant_id, case_sensitive: false },
@@ -52,8 +55,10 @@ module Masks
                 allow_blank: true
 
       validate :named
+      validate :nickname_free, if: -> { nickname.present? && will_save_change_to_nickname? && !trusted_rename }
 
       before_save :activate_once_a_password_exists
+      after_save :release_previous_nickname, if: :saved_change_to_nickname?
       before_save :forget_code_factors_for_new_addresses
       after_update :forget_mailed_links, if: :saved_change_to_email?
 
@@ -190,14 +195,14 @@ module Masks
         holds?(Scopes::MANAGE)
       end
 
-      def person_json
+      def card_json
         style = Avatars.held?(self) ? Avatars::PHOTO : Avatars::FALLBACK
 
         {
           "name" => display_name,
           "details" => display_details,
-          "note" => (I18n.t("application.person.unconfirmed") if email_unconfirmed?),
-          "role" => (I18n.t("application.person.manager") if manages?),
+          "note" => (I18n.t("application.actor.unconfirmed") if email_unconfirmed?),
+          "role" => (I18n.t("application.actor.manager") if manages?),
           "avatar" => Avatars.url(self, style, subject: uuid, size: 128)
         }
       end
@@ -282,11 +287,16 @@ module Masks
 
         held.find_each(&:revoke!)
         RefreshToken.where(actor_id: id).live.find_each(&:revoke!)
+
+        issued = AccessToken.where(actor_id: id).live
+        issued = issued.where.not(session_id: keeping.id) if keeping
+        issued.update_all(consumed_at: Time.current, updated_at: Time.current)
+
         DeviceFactor.forget!(actor: self)
       end
 
       def notified?(action)
-        Notifications.mailed?(action) && !muted_notifications.include?(action.to_s)
+        Notifications.mailed?(action) && (Notifications.always?(action) || !muted_notifications.include?(action.to_s))
       end
 
       def notifications
@@ -294,7 +304,7 @@ module Masks
       end
 
       def notifications=(wanted)
-        self.muted_notifications = Notifications::MAILED - Array(wanted).map(&:to_s)
+        self.muted_notifications = Notifications::MUTABLE - Array(wanted).map(&:to_s)
       end
 
       def otp?
@@ -508,6 +518,19 @@ module Masks
           end
         end
 
+        def nickname_free
+          errors.add(:nickname, :held) if ReleasedNickname.held_from?(nickname, self)
+        end
+
+        def release_previous_nickname
+          ReleasedNickname.where(nickname: nickname.to_s.downcase, actor_id: id).delete_all if nickname.present?
+          ReleasedNickname.release!(nickname_before_last_save, actor: self)
+        end
+
+        def release_nickname
+          ReleasedNickname.release!(nickname, actor: self)
+        end
+
         def manages_by_both
           errors.add(:nickname, :blank) if nickname.blank?
           errors.add(:email, :blank) if email.blank?

data/app/models/masks/server/client.rb

@@ -82,6 +82,8 @@ module Masks
       validate :resources_are_named_only_when_approved
       validates :access_token_lifetime, numericality: { only_integer: true, in: 60..1.day.to_i }, allow_nil: true
       validates :refresh_token_lifetime, numericality: { only_integer: true, in: 5.minutes.to_i..400.days.to_i }, allow_nil: true
+      validates :refresh_token_absolute_lifetime, numericality: { only_integer: true, in: 5.minutes.to_i..400.days.to_i },
+                                                  allow_nil: true
       validates :consent_lifetime, numericality: { only_integer: true, greater_than_or_equal_to: 300,
                                                    less_than_or_equal_to: Consent::LONGEST.to_i }, allow_nil: true
 
@@ -123,7 +125,7 @@ module Masks
           {
             name: handshake.name,
             redirect_uris: handshake.redirect_uris,
-            post_logout_redirect_uris: [ handshake.return_to ].compact,
+            post_logout_redirect_uris: [ handshake.post_logout_redirect_uri ].compact,
             resources: [ handshake.resource ],
             allowed_scopes: Scopes.join(handshake.scopes),
             grant_types: handshake.grant_types,
@@ -131,6 +133,7 @@ module Masks
             token_endpoint_auth_method: handshake.auth_method,
             backchannel_logout_uri: handshake.backchannel_logout_uri,
             client_uri: handshake.origin,
+            handshake_return_to: handshake.return_to,
             dynamic: false
           }
         end
@@ -169,8 +172,7 @@ module Masks
             name: held[:name] || name,
             grant_types: grant_types,
             response_types: held[:response_types].presence || response_types_for(grant_types),
-            allowed_scopes: Scopes.join(bounded(metadata.to_h.stringify_keys["scope"].presence ||
-                                                Current.tenant&.dynamic_client_ceiling || DEFAULT_SCOPES)),
+            allowed_scopes: Scopes.join(declared_scopes(metadata)),
             dynamic: true
           )
         end
@@ -206,6 +208,12 @@ module Masks
           ).issue_credentials!
         end
 
+        def declared_scopes(metadata)
+          declared = metadata.to_h.stringify_keys["scope"]
+
+          Scopes.list(declared).empty? ? [] : bounded(declared)
+        end
+
         def bounded(requested)
           reserved = Scopes.reserved(requested) + Scopes.list(requested).select { |s| Scopes.prefix?(s) }
 
@@ -371,6 +379,11 @@ module Masks
 
       def authenticate_secret(candidate)
         return true if public?
+
+        secret_matches?(candidate) && !secret_expired?
+      end
+
+      def secret_matches?(candidate)
         return false unless secret?
         return false if secret_digest.blank? || candidate.blank?
 
@@ -379,8 +392,12 @@ module Masks
         false
       end
 
+      def secret_expired?
+        secret_expires_at.present? && secret_expires_at.past?
+      end
+
       def redirect_uri?(candidate)
-        redirect_uris.include?(candidate.to_s)
+        redirect_uris.include?(candidate.to_s) || redirect_uris.any? { |registered| same_loopback?(registered, candidate.to_s) }
       end
 
       def grants?(grant_type)
@@ -424,7 +441,11 @@ module Masks
       end
 
       def scope_list
-        Scopes.union(required_scopes, allowed_scopes)
+        Scopes.union(required_scopes, offered_scopes)
+      end
+
+      def follows_registration?
+        dynamic? && Scopes.list(allowed_scopes).empty?
       end
 
       def access_lifetime
@@ -435,6 +456,10 @@ module Masks
         refresh_token_lifetime&.seconds || RefreshToken.lifetime
       end
 
+      def refresh_absolute_lifetime
+        refresh_token_absolute_lifetime&.seconds || RefreshToken.absolute_lifetime
+      end
+
       def admits?(actor)
         allowed_groups.empty? || actor.group_labels.intersect?(allowed_groups)
       end
@@ -442,7 +467,19 @@ module Masks
       def permitted_scopes(requested)
         return scope_list if Scopes.list(requested).empty?
 
-        Scopes.union(required_scopes, Scopes.granted(requested, allowed_scopes))
+        return Scopes.union(required_scopes, unreserved(requested)) if open_to_anything?
+
+        Scopes.union(required_scopes, Scopes.granted(requested, offered_scopes))
+      end
+
+      def refused_scopes(requested)
+        Scopes.list(requested) - permitted_scopes(requested)
+      end
+
+      def offered_scopes
+        return Scopes.list(allowed_scopes) unless follows_registration?
+
+        Current.tenant&.dynamic_client_ceiling || DEFAULT_SCOPES
       end
 
       def metadata
@@ -544,6 +581,24 @@ module Masks
           self.class.loopback?(uri)
         end
 
+        def open_to_anything?
+          follows_registration? && Current.tenant&.dynamic_registration == Tenant::REGISTRATION_ANYTHING
+        end
+
+        def unreserved(requested)
+          Scopes.list(requested).reject { |scope| Scopes.prefix?(scope) || Scopes.reserved(scope).any? }
+        end
+
+        def same_loopback?(registered, candidate)
+          held = URI.parse(registered)
+          asked = URI.parse(candidate)
+
+          [ held, asked ].all? { |uri| uri.instance_of?(URI::HTTP) && LOOPBACK.include?(uri.hostname) && uri.userinfo.nil? && uri.fragment.nil? } &&
+            held.hostname == asked.hostname && held.path == asked.path && held.query == asked.query
+        rescue URI::InvalidURIError
+          false
+        end
+
         def grant_types_are_known
           unknown = grant_types - GRANT_TYPES
           errors.add(:grant_types, "not supported: #{unknown.join(', ')}") if unknown.any?

data/app/models/masks/server/client_keys.rb

@@ -78,7 +78,7 @@ module Masks
         raise Refused, "#{algorithm.presence || 'that'} is not an algorithm #{subject} may be signed with" unless ALGORITHMS.include?(algorithm)
 
         verified = attempt(token, header, algorithm, fresh: false)
-        verified ||= attempt(token, header, algorithm, fresh: true) if remote? && unknown_kid?(header)
+        verified ||= attempt(token, header, algorithm, fresh: true) if remote? && unknown_kid?(header) && refetch_open?
 
         verified || raise(Refused, "#{subject} was not signed by a key this client registered")
       rescue JWT::DecodeError
@@ -127,9 +127,20 @@ module Masks
           kid ? held.select { |jwk| jwk["kid"] == kid } : held
         end
 
+        def refetch_open?
+          return false if ::Rails.cache.exist?(refetched_key)
+
+          ::Rails.cache.write(refetched_key, Time.current.to_i, expires_in: LIFETIME)
+          true
+        end
+
         def cache_key
           "client-jwks:#{client.tenant_id}:#{client.id}:#{Digest::SHA256.hexdigest(client.jwks_uri.to_s)}"
         end
+
+        def refetched_key
+          "#{cache_key}:refetched"
+        end
     end
   end
 end

data/app/models/masks/server/declared.rb

@@ -5,7 +5,7 @@ module Masks
 
       TENANT_KEYS = %w[name accent_color groups apps].freeze
       APP_KEYS = %w[preset url slug name client_id client_secret_env redirect_uris scopes allowed_groups
-                    access_token_lifetime refresh_token_lifetime].freeze
+                    access_token_lifetime refresh_token_lifetime refresh_token_absolute_lifetime].freeze
 
       def self.apply!(path = ::Rails.configuration.masks.config_path)
         return [] if path.blank?
@@ -92,6 +92,7 @@ module Masks
             allowed_groups: Array(declared["allowed_groups"]),
             access_token_lifetime: declared["access_token_lifetime"],
             refresh_token_lifetime: declared["refresh_token_lifetime"],
+            refresh_token_absolute_lifetime: declared["refresh_token_absolute_lifetime"],
             consent_required: false
           }
 

data/app/models/masks/server/event.rb

@@ -18,6 +18,7 @@ module Masks
 
       ACCOUNT_CREATED = "account.created".freeze
       ACCOUNT_EXPORTED = "account.exported".freeze
+      NOTIFICATIONS_CHANGED = "notifications.changed".freeze
       INVITATION_SENT = "invitation.sent".freeze
       INVITATION_ACCEPTED = "invitation.accepted".freeze
 

data/app/models/masks/server/handshake.rb

@@ -4,7 +4,7 @@ module Masks
       GRANT_TYPES = %w[authorization_code refresh_token].freeze
 
       attr_reader :name, :redirect_uris, :resource, :scopes, :return_to, :state, :auth_method,
-                  :backchannel_logout_uri
+                  :backchannel_logout_uri, :post_logout_redirect_uri
 
       class << self
         def from_request(request)
@@ -19,7 +19,8 @@ module Masks
             return_to: params["return_to"],
             state: params["state"],
             auth_method: params["token_endpoint_auth_method"],
-            backchannel_logout_uri: params["backchannel_logout_uri"]
+            backchannel_logout_uri: params["backchannel_logout_uri"],
+            post_logout_redirect_uri: params["post_logout_redirect_uri"]
           )
         end
 
@@ -36,7 +37,8 @@ module Masks
             return_to: row.redirect_uri,
             state: held["state"],
             auth_method: held["auth_method"],
-            backchannel_logout_uri: held["backchannel_logout_uri"]
+            backchannel_logout_uri: held["backchannel_logout_uri"],
+            post_logout_redirect_uri: held["post_logout_redirect_uri"]
           )
         end
       end
@@ -54,7 +56,8 @@ module Masks
           "state" => state,
           "redirect_uris" => redirect_uris.sort,
           "auth_method" => auth_method,
-          "backchannel_logout_uri" => backchannel_logout_uri
+          "backchannel_logout_uri" => backchannel_logout_uri,
+          "post_logout_redirect_uri" => post_logout_redirect_uri
         }.compact
       end
 
@@ -73,12 +76,14 @@ module Masks
 
         pairs << [ "state", state ] if state
         pairs << [ "backchannel_logout_uri", backchannel_logout_uri ] if backchannel_logout_uri
+        pairs << [ "post_logout_redirect_uri", post_logout_redirect_uri ] if post_logout_redirect_uri
         redirect_uris.each { |uri| pairs << [ "redirect_uris", uri ] }
         pairs
       end
 
       def initialize(name: nil, redirect_uris: nil, resource: nil, scopes: nil,
-                     return_to: nil, state: nil, auth_method: nil, backchannel_logout_uri: nil)
+                     return_to: nil, state: nil, auth_method: nil, backchannel_logout_uri: nil,
+                     post_logout_redirect_uri: nil)
         @name = name.to_s.strip.presence || "An application"
         @redirect_uris = Array(redirect_uris).map(&:to_s).reject(&:empty?).uniq
         @resource = resource.to_s
@@ -87,6 +92,7 @@ module Masks
         @state = state.presence
         @auth_method = auth_method.to_s.presence || Client::DEFAULT_AUTH_METHOD
         @backchannel_logout_uri = backchannel_logout_uri.to_s.strip.presence
+        @post_logout_redirect_uri = post_logout_redirect_uri.to_s.strip.presence
       end
 
       def origin
@@ -134,7 +140,7 @@ module Masks
             return "token_endpoint_auth_method must be one of #{Client::AUTH_METHODS.join(', ')}"
           end
 
-          elsewhere = ([ return_to ] + redirect_uris + Array(backchannel_logout_uri))
+          elsewhere = ([ return_to ] + redirect_uris + Array(backchannel_logout_uri) + Array(post_logout_redirect_uri))
             .reject { |uri| origin_of(uri) == origin }
           return "everything must share the origin #{origin}: #{elsewhere.join(', ')}" if elsewhere.any?
 

data/app/models/masks/server/login.rb

@@ -416,8 +416,7 @@ module Masks
             "rid" => rid,
             "docs" => ::Rails.configuration.masks.docs_url,
             "actor" => actor && { "nickname" => actor.nickname, "name" => actor.name,
-                                  "identifier" => actor.identifier },
-            "person" => person_json,
+                                  "identifier" => actor.identifier, "card" => card_json },
             "client" => client_json,
             "tenant" => tenant && {
               "name" => tenant.name, "logo" => tenant.logo_url
@@ -429,10 +428,8 @@ module Masks
           answering.reduce(base) { |json, state| state.enabled? ? json.merge(state.as_json) : json }
         end
 
-        def person_json
-          return nil if actor.nil? || authenticated_at.nil?
-
-          actor.person_json
+        def card_json
+          actor.card_json if authenticated_at
         end
 
         def forget_vanished_actor!

data/app/models/masks/server/notifications.rb

@@ -51,6 +51,10 @@ module Masks
 
       MAILED = GROUPS.values.flatten.freeze
 
+      ALWAYS = [ Event::PASSWORD_CHANGED, Event::PASSWORD_RESET_COMPLETED, Event::SIGN_IN_RISKY ].freeze
+
+      MUTABLE = (MAILED - ALWAYS).freeze
+
       ONCE_PER_DEVICE = [ Event::SESSION_STARTED ].freeze
 
       class << self
@@ -58,6 +62,10 @@ module Masks
           MAILED.include?(action.to_s)
         end
 
+        def always?(action)
+          ALWAYS.include?(action.to_s)
+        end
+
         def raised(event)
           return false unless mailed?(event.action) || WARNS_PREVIOUS.include?(event.action)
           return false unless event.actor_id && ActorMailer.deliverable?

data/app/models/masks/server/pending_handshake.rb

@@ -19,7 +19,8 @@ module Masks
             "redirect_uris" => handshake.redirect_uris,
             "state" => handshake.state,
             "auth_method" => handshake.auth_method,
-            "backchannel_logout_uri" => handshake.backchannel_logout_uri
+            "backchannel_logout_uri" => handshake.backchannel_logout_uri,
+            "post_logout_redirect_uri" => handshake.post_logout_redirect_uri
           }.compact
         )
       end

data/app/models/masks/server/pending_request.rb

@@ -39,6 +39,14 @@ module Masks
         held("max_age")
       end
 
+      def refuse!(error, description)
+        update!(payload: (payload || {}).merge("refusal" => { "error" => error, "description" => description }))
+      end
+
+      def refusal
+        held("refusal")
+      end
+
       def issue_code!(actor:, device: nil, session: nil, authenticated_at: nil, amr: nil, organization: nil)
         AuthorizationCode.mint!(
           organization: organization,

data/app/models/masks/server/refresh_token.rb

@@ -5,6 +5,14 @@ module Masks
         30.days
       end
 
+      def self.absolute_lifetime
+        90.days
+      end
+
+      def exhausted?(limit)
+        root.created_at + limit <= Time.current
+      end
+
       def self.mint!(**attributes)
         super.tap { |token| token.actor&.active! }
       end

data/app/models/masks/server/released_nickname.rb

@@ -0,0 +1,26 @@
+module Masks
+  module Server
+    class ReleasedNickname < ApplicationRecord
+      include TenantScoped
+
+      HOLD = 30.days
+
+      belongs_to :actor, optional: true
+
+      scope :holding, ->(nickname) { where(nickname: nickname.to_s.downcase).where("released_at > ?", HOLD.ago) }
+      scope :lapsed, -> { where(released_at: ...HOLD.ago) }
+
+      class << self
+        def release!(nickname, actor:)
+          return if nickname.blank?
+
+          find_or_initialize_by(nickname: nickname.downcase).update!(actor: actor, released_at: Time.current)
+        end
+
+        def held_from?(nickname, actor)
+          holding(nickname).where.not(actor_id: actor.id).or(holding(nickname).where(actor_id: nil)).exists?
+        end
+      end
+    end
+  end
+end

data/app/models/masks/server/scim/filter.rb

@@ -1,8 +1,14 @@
+require "strscan"
+
 module Masks
   module Server
     module Scim
       class Filter
-        COMPARISON = /\A\s*([A-Za-z][\w.:\[\]" -]*?)\s+(eq|ne|co|sw|ew|pr|gt|ge|lt|le)(?:\s+("(?:[^"\\]|\\.)*"|true|false|null|[\d.]+))?\s*\z/i
+        LONGEST = 512
+        TOKEN = /"(?:[^"\\]|\\.)*"|(?:[^\s"\[]|\[[^\]]*\])+/
+        PATH = /\A[A-Za-z][\w.:\[\]" ]*\z/
+        VALUE = /\A(?:"(?:[^"\\]|\\.)*"|true|false|null|[\d.]+)\z/
+        OPERATORS = %w[eq ne co sw ew pr gt ge lt le].freeze
         ATTRIBUTES = {
           "id" => "actors.uuid",
           "username" => :user_name,
@@ -30,7 +36,9 @@ module Masks
         end
 
         def apply(relation)
-          clauses = @expression.split(/\s+and\s+/i)
+          raise Error.new(:bad_request, "a filter is at most #{LONGEST} characters", scim_type: "invalidFilter") if @expression.length > LONGEST
+
+          clauses = clauses_of(tokens)
 
           raise Error.new(:bad_request, "at most four comparisons joined by and are understood", scim_type: "invalidFilter") if clauses.size > 4
 
@@ -39,12 +47,44 @@ module Masks
 
         private
 
+          def tokens
+            scanner = StringScanner.new(@expression)
+            held = []
+
+            until scanner.eos?
+              next if scanner.skip(/\s+/)
+
+              token = scanner.scan(TOKEN)
+
+              raise unreadable(@expression) if token.nil?
+
+              held << token
+            end
+
+            held
+          end
+
+          def clauses_of(tokens)
+            clauses = [ [] ]
+
+            tokens.each do |token|
+              token.casecmp?("and") ? clauses << [] : clauses.last << token
+            end
+
+            clauses
+          end
+
+          def unreadable(clause)
+            Error.new(:bad_request, "#{clause.strip} is not a filter this server reads", scim_type: "invalidFilter")
+          end
+
           def compare(relation, clause)
-            match = COMPARISON.match(clause)
+            path, operator, raw = clause
 
-            raise Error.new(:bad_request, "#{clause.strip} is not a filter this server reads", scim_type: "invalidFilter") if match.nil?
+            raise unreadable(clause.join(" ")) unless clause.size.between?(2, 3)
+            raise unreadable(clause.join(" ")) unless PATH.match?(path) && OPERATORS.include?(operator.downcase)
+            raise unreadable(clause.join(" ")) unless raw.nil? || VALUE.match?(raw)
 
-            path, operator, raw = match.captures
             key = normalized(path)
             column = @columns[key]
             operator = operator.downcase

data/app/models/masks/server/scim/user.rb

@@ -118,6 +118,7 @@ module Masks
             raise Error.new(:bad_request, "userName is required", scim_type: "invalidValue") if value.blank?
 
             held = value.to_s.strip
+            actor.trusted_rename = true
 
             if held.match?(URI::MailTo::EMAIL_REGEXP)
               actor.email = held

data/app/models/masks/server/session.rb

@@ -23,7 +23,7 @@ module Masks
 
       class << self
         def start!(actor:, device: nil, user_agent: nil, ip_address: nil, amr: [], origin: nil, policy: nil,
-                   first_factor: {})
+                   first_factor: {}, authenticated_at: nil)
           secret = SecureRandom.urlsafe_base64(48)
           lifetime = policy&.session_lifetime&.seconds || LIFETIME
           now = Time.current
@@ -36,7 +36,7 @@ module Masks
             user_agent: user_agent,
             ip_address: ip_address,
             origin: origin.presence || Current.origin,
-            authenticated_at: now,
+            authenticated_at: authenticated_at || now,
             last_seen_at: now,
             amr: Array(amr),
             first_factor: first_factor["factor"],
@@ -71,10 +71,11 @@ module Masks
         { "factor" => first_factor, "provider_id" => provider_id }.compact
       end
 
-      def first_factored!(held)
-        return if held["factor"].blank? || held == first_factored_by
+      def first_factored!(held, at: nil)
+        self.authenticated_at = at if at && at > authenticated_at
+        assign_attributes(first_factor: held["factor"], provider_id: held["provider_id"]) if held["factor"].present?
 
-        update!(first_factor: held["factor"], provider_id: held["provider_id"])
+        save! if changed?
       end
 
       def bound?

data/app/policies/masks/server/exchange_policy.rb

@@ -85,7 +85,7 @@ module Masks
         end
 
         def scopes_stay_within_the_client
-          beyond = Scopes.refused(client.scope_list, requested_scopes)
+          beyond = client.refused_scopes(requested_scopes)
 
           deny!("invalid_scope", "this client may not hold #{beyond.join(', ')}") if beyond.any?
         end

data/app/policies/masks/server/grant_checks.rb

@@ -8,7 +8,7 @@ module Masks
         end
 
         def scopes_are_permitted
-          refused = Scopes.refused(client.scope_list, requested_scopes)
+          refused = client.refused_scopes(requested_scopes)
 
           if refused.any?
             deny!("invalid_scope",

data/app/views/masks/server/account/_info.html.erb

@@ -4,7 +4,7 @@
   <div class="entries">
     <details class="entry" id="profile">
       <summary>
-        <span class="entry-icon"><%= account_icon(:person) %></span>
+        <span class="entry-icon"><%= account_icon(:actor) %></span>
         <span class="entry-label"><%= account_text("profile.heading") %></span>
         <span class="entry-state"><%= actor.name.presence || actor.nickname %></span>
         <span class="entry-mark" aria-hidden="true"></span>
@@ -46,7 +46,11 @@
       </summary>
 
       <div class="entry-body">
-        <p class="aside"><%= account_text("notifications.lede") %></p>
+        <p class="aside"><%= account_text("notifications.lede") %> <%= account_text("notifications.kept") %></p>
+
+        <% unless fresh %>
+          <p class="aside"><%= account_text("notifications.again") %></p>
+        <% end %>
 
         <% unless Masks::Server::Notifications.mailable?(actor) %>
           <p class="aside aside-bad"><%= account_text("notifications.silent") %></p>
@@ -63,8 +67,12 @@
                 <% actions.each do |action| %>
                   <label class="switch">
                     <span><%= t("events.actions.#{action}") %></span>
-                    <%= check_box_tag "notifications[]", action, actor.notified?(action),
-                          id: "notify-#{action.tr('.', '-')}" %>
+                    <% if Masks::Server::Notifications.always?(action) %>
+                      <span class="switch-kept"><%= account_text("notifications.always") %></span>
+                    <% else %>
+                      <%= check_box_tag "notifications[]", action, actor.notified?(action),
+                            id: "notify-#{action.tr('.', '-')}" %>
+                    <% end %>
                   </label>
                 <% end %>
               </div>
@@ -72,7 +80,7 @@
           <% end %>
 
           <div class="action-row">
-            <button type="submit" class="action action-sm"><%= account_text("notifications.submit") %></button>
+            <button type="submit" class="action action-sm"><%= account_text(fresh ? "notifications.submit" : "notifications.submit_again") %></button>
           </div>
         <% end %>
       </div>