masks-server 0.9.0 → 0.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 36e33f34e755bbbb4470a5c55b920624f2042678b87c810ce614e86f9638a4df
-  data.tar.gz: 2bf178807ba578015922b44145ad0eb28454698adb877ac51b5059be57a35ca3
+  metadata.gz: 544dc01d0600507eb713667f0d8cf57275b4b7d957b603e3085f9e197e7e63c6
+  data.tar.gz: 70f664c959b40e98e9a273582a45c0dba352e5186430a72c26e3a8dd87db978b
 SHA512:
-  metadata.gz: 3d32dd6592c56c0132971c1f322ca90b2a31df6832c0b9fe33d5c41c7d5d7aab443b4c6b2fec0a9d3ac0635b22b6d86bbda1c451bd791fd3794e4776c1edd1c8
-  data.tar.gz: 59f5658c277590947cf74f3b8e57fe2d9d7b01f1a160bdc3bdbc3593f4aba9b9395b08255b866e54029f48aff6d9b7b1384daf9ab1b21b95f7468678a800fbcb
+  metadata.gz: a5c6177ca713658c3003f33cea0b8902c6810266271f4d4e6d0215d8a291b6da13a47add90dca3b65df3f9614f6161dd5627853c3e9038ddafffcc0963ce27d4
+  data.tar.gz: 872c0d7ce2bd4090f885fdbce3eb82d8459ff73840ac89d3bd9cd2088ae334dc1efb2c34fe7bc17a2f413492d07c15c74a69f73b771f98847a4a69ae10416228

data/app/controllers/concerns/masks/server/client_authentication.rb

@@ -16,9 +16,10 @@ module Masks
           client_refused!("no client is registered with that client_id") if client.nil?
           client_refused!("this client authenticates with a signed assertion, not a secret") if client.asserts?
 
-          client_refused! unless client.authenticate_secret(secret)
+          return client if client.authenticate_secret(secret)
 
-          client
+          client_refused!("this client's secret expired on #{client.secret_expires_at.iso8601}, and a manager rotates it") if client.secret_expired? && client.secret_matches?(secret)
+          client_refused!
         end
 
         def asserted_client(assertion)

data/app/controllers/masks/server/addresses_controller.rb

@@ -8,6 +8,7 @@ module Masks
                  only: :update
 
       before_action :require_actor
+      before_action :known_channel
       before_action -> { reauthenticated!(anchor, t("addresses.again")) }
       before_action :refuse_directed
 
@@ -55,7 +56,11 @@ module Masks
       private
 
         def channel
-          params[:channel].to_s
+          @channel ||= Addresses::CHANNELS.keys.find { |known| known == params[:channel].to_s }
+        end
+
+        def known_channel
+          head :not_found if channel.nil?
         end
 
         def anchor

data/app/controllers/masks/server/application_controller.rb

@@ -264,6 +264,34 @@ module Masks
           )
         end
 
+        def answerable?(pending)
+          authorization = pending.authorization
+
+          authorization.client&.approved? || ours?(authorization.redirect_uri)
+        end
+
+        def refuse_on_masks(pending, refusal)
+          pending.refuse!(refusal.error, refusal.description)
+          PendingRequest.claim(rid_for(pending))
+
+          authorize_refused_path(rid: rid_for(pending))
+        end
+
+        def refused_request(rid)
+          return nil if rid.blank? || !tracked(REQUESTS).value?(rid)
+
+          PendingRequest.spent(rid)&.then { |held| held if held.consumed? }
+        end
+
+        def ours?(target)
+          here = URI.parse(issuer.url)
+          there = URI.parse(target.to_s)
+
+          there.scheme == here.scheme && there.host == here.host && there.port == here.port
+        rescue URI::InvalidURIError
+          false
+        end
+
         def authorize_url_for(pending)
           "#{authorize_path}?#{URI.encode_www_form(pending.authorization.query_pairs)}"
         end
@@ -303,7 +331,7 @@ module Masks
 
         def settle!(login)
           hold(login.actor, amr: login.amr, policy: login.policy, first_factor: login.first_factored_by,
-                            authenticated_at: login.factored_at(:first_factor))
+                            authenticated_at: login.authenticated_at)
           forget_login
         end
 

data/app/controllers/masks/server/authorize_controller.rb

@@ -45,6 +45,7 @@ module Masks
 
         login = advance(pending)
 
+        return redirect_to(refuse_on_masks(pending, login.refusal)) if login.refused? && !answerable?(pending)
         return answer(deny(pending, login.refusal.error, login.refusal.description)) if login.refused?
         return interaction_required(pending) if login.prompted? && pending.silent?
         return redirect_to(login.redirect_to, allow_other_host: true) if login.redirect_to.present?
@@ -53,6 +54,15 @@ module Masks
         complete(pending, attempt, login)
       end
 
+      def refused
+        refusal = refused_request(params[:rid])&.refusal
+
+        return show_error("invalid_request", "that sign-in request has expired", :bad_request) if refusal.nil?
+
+        @refused = true
+        show_error(refusal["error"], refusal["description"], :forbidden)
+      end
+
       private
 
         def validate(authorization)
@@ -66,6 +76,7 @@ module Masks
             req.verify_redirect_uri!(client.redirect_uri?(req.redirect_uri) ? [ req.redirect_uri.to_s ] : client.redirect_uris)
             req.verified_redirect_uri = with_issuer(req.verified_redirect_uri)
             res.redirect_uri = req.verified_redirect_uri
+            req.verified_redirect_uri = nil unless hears_errors?(client, req.redirect_uri)
 
             permit(req) { authorization.validate! }
           end
@@ -97,7 +108,7 @@ module Masks
             actor: current_actor,
             device: current_device,
             session: current_session,
-            authenticated_at: login.authenticated_at || current_session&.authenticated_at,
+            authenticated_at: current_session&.authenticated_at,
             amr: login.amr.presence || current_session&.amr,
             organization: login.state("organization-choice").selected
           )
@@ -121,21 +132,20 @@ module Masks
           client = Client.authenticating(params[:client_id])
           target = params[:redirect_uri].to_s
 
-          if target.present? && (client&.redirect_uri?(target) || ours?(target))
+          if target.present? && hears_errors?(client, target)
             return redirect_to refusal_uri(target, error), allow_other_host: true
           end
 
-          @error_code = error.error.to_s
-          @error_description = error.description
+          show_error(error.error.to_s, error.description, error.status)
+        end
+
+        def show_error(code, description, status)
+          @error_code = code
+          @error_description = description
 
           respond_to do |format|
-            format.html { render :error, status: error.status }
-            format.any do
-              render json: {
-                "error" => @error_code,
-                "error_description" => @error_description
-              }, status: error.status
-            end
+            format.html { render :error, status: status }
+            format.any { render json: { "error" => code, "error_description" => description }, status: status }
           end
         end
 
@@ -163,13 +173,8 @@ module Masks
           Rack::OAuth2::Server::Authorize::BadRequest.new(error, description)
         end
 
-        def ours?(target)
-          here = URI.parse(issuer.url)
-          there = URI.parse(target.to_s)
-
-          there.scheme == here.scheme && there.host == here.host && there.port == here.port
-        rescue URI::InvalidURIError
-          false
+        def hears_errors?(client, target)
+          ours?(target) || (client.present? && client.approved? && client.redirect_uri?(target))
         end
 
         def refusal_uri(target, error)

data/app/controllers/masks/server/device_verifications_controller.rb

@@ -59,7 +59,7 @@ module Masks
             actor: current_actor,
             session: current_session,
             device: current_device,
-            authenticated_at: login.authenticated_at || current_session&.authenticated_at,
+            authenticated_at: current_session&.authenticated_at,
             amr: login.amr.presence || current_session&.amr,
             organization: login.state("organization-choice").selected
           )

data/app/controllers/masks/server/logins_controller.rb

@@ -152,7 +152,7 @@ module Masks
 
           if login.touched?(:first_factor)
             sign_in(login.actor, amr: login.amr, policy: login.policy, first_factor: login.first_factored_by,
-                                 authenticated_at: login.factored_at(:first_factor))
+                                 authenticated_at: login.authenticated_at)
           elsif login.signed_in? && login.touched?(:second_factor)
             current_session.update!(amr: Array(current_session.amr) | login.amr)
           end
@@ -191,6 +191,7 @@ module Masks
           return refuse_device(pending) if login.refused? && pending&.device?
           return refuse_saml(pending) if login.refused? && pending&.saml?
           return saml_resume_path(rid: rid_for(pending)) if pending&.saml?
+          return refuse_on_masks(pending, login.refusal) if login.refused? && pending && !answerable?(pending)
           return deny(pending, login.refusal.error, login.refusal.description) if login.refused? && pending
           return device_url_for(pending) if pending&.device?
           return authorize_url_for(pending) if pending

data/app/controllers/masks/server/notifications_controller.rb

@@ -2,9 +2,19 @@ module Masks
   module Server
     class NotificationsController < ApplicationController
       before_action :require_actor
+      before_action -> { reauthenticated!("notifications", t("notifications.again")) }
 
       def update
+        was = current_actor.muted_notifications
         current_actor.update!(notifications: wanted)
+        now = current_actor.muted_notifications
+
+        muted = now - was
+        unmuted = was - now
+
+        if muted.any? || unmuted.any?
+          Event.record!(Event::NOTIFICATIONS_CHANGED, actor: current_actor, muted: muted, unmuted: unmuted)
+        end
 
         redirect_to "#{root_path}#notifications", notice: t("notifications.saved")
       end
@@ -12,7 +22,7 @@ module Masks
       private
 
         def wanted
-          Array(params[:notifications]).map(&:to_s) & Notifications::MAILED
+          Array(params[:notifications]).map(&:to_s) & Notifications::MUTABLE
         end
 
         def require_actor

data/app/controllers/masks/server/profiles_controller.rb

@@ -5,6 +5,7 @@ module Masks
 
       def update
         return refuse(t("profiles.directed")) if current_actor.directed?
+        return unless kept_nickname? || reauthenticated!("profile", t("profiles.again"))
 
         current_actor.assign_attributes(profile)
         changed = current_actor.changed
@@ -22,6 +23,10 @@ module Masks
           params.permit(:name, :nickname).to_h.transform_values { |value| value.strip.presence }
         end
 
+        def kept_nickname?
+          !profile.key?("nickname") || profile["nickname"] == current_actor.nickname
+        end
+
         def require_actor
           redirect_to login_path unless current_actor
         end

data/app/controllers/masks/server/saml_controller.rb

@@ -139,7 +139,7 @@ module Masks
           assertion = response_for(pending)
           encoded = assertion.success(
             actor: current_actor, session: current_session, name_id_format: saml["name_id_format"], scopes: scopes,
-            authenticated_at: login.authenticated_at || current_session&.authenticated_at,
+            authenticated_at: current_session&.authenticated_at,
             amr: login.amr.presence || current_session&.amr
           )
 
@@ -174,12 +174,6 @@ module Masks
           )
         end
 
-        def refused_request(rid)
-          return nil if rid.blank? || !tracked(REQUESTS).value?(rid)
-
-          PendingRequest.spent(rid)&.then { |held| held if held.consumed? }
-        end
-
         def post(pending, encoded)
           post_saml(pending.client, pending.redirect_uri, "SAMLResponse", encoded, relay_state: pending.held("saml")["relay_state"])
         end

data/app/controllers/masks/server/tokens_controller.rb

@@ -124,6 +124,7 @@ module Masks
 
           req.invalid_grant!("that refresh token was issued to another client") if token.client_id != client.id
           req.invalid_grant!("the session that refresh token was issued in has ended") if outlived?(token)
+          exhausted!(req, token, client)
           member!(req, token)
           consented!(req, token, client)
           Current.organization = token.organization
@@ -180,6 +181,13 @@ module Masks
           held.present? && held.bounded? && !held.live?
         end
 
+        def exhausted!(req, token, client)
+          return unless token.exhausted?(client.refresh_absolute_lifetime)
+
+          token.revoke_family!
+          req.invalid_grant!("the sign-in behind that refresh token is older than #{client.name} allows")
+        end
+
         def replayed!(spent, client)
           return if spent.nil? || !spent.consumed?
 

data/app/graphql/masks/server/manage/mutations/create_actor.rb

@@ -18,6 +18,7 @@ module Masks
             granting!(scopes)
 
             actor = Actor.new(
+              trusted_rename: true,
               nickname: nickname,
               email: email,
               scopes: Scopes.join(Scopes.list(scopes).presence || Scopes::STANDARD)

data/app/graphql/masks/server/manage/mutations/update_actor.rb

@@ -29,6 +29,7 @@ module Masks
             needs!(:security, "changing someone's email address") if changing_email
             previous = actor.email if changing_email && actor.email_verified_at.present?
 
+            actor.trusted_rename = true
             actor.assign_attributes(attributes)
             actor.email_verified_at = nil if changing_email
             actor.phone_verified_at = nil if attributes.key?(:phone) && actor.phone_changed?

data/app/graphql/masks/server/manage/mutations/update_client.rb

@@ -36,6 +36,9 @@ module Masks
                    description: "Seconds an access token lasts, from 60 to a day. Zero goes back to an hour."
           argument :refresh_token_lifetime, Integer, required: false,
                    description: "Seconds a refresh token lasts unused, from 300 to 400 days. Zero goes back to 30 days."
+          argument :refresh_token_absolute_lifetime, Integer, required: false,
+                   description: "Seconds from a sign-in until its refresh tokens stop, however often they are used, " \
+                                "from 300 to 400 days. Zero goes back to 90 days."
           argument :allowed_groups, [ String ], required: false,
                    description: "Group keys, or organization roles as key:role, whose people may sign in to this client. Empty lets everyone in."
           argument :sign_in_policy, ID, required: false
@@ -68,6 +71,7 @@ module Masks
             attributes[:consent_lifetime] = nil if attributes[:consent_lifetime]&.zero?
             attributes[:access_token_lifetime] = nil if attributes[:access_token_lifetime]&.zero?
             attributes[:refresh_token_lifetime] = nil if attributes[:refresh_token_lifetime]&.zero?
+            attributes[:refresh_token_absolute_lifetime] = nil if attributes[:refresh_token_absolute_lifetime]&.zero?
             client.assign_attributes(attributes)
             client.response_types = client.default_response_types if attributes.key?(:grant_types)
             client.required_scopes = Scopes.join(required_scopes) unless required_scopes.nil?

data/app/graphql/masks/server/manage/types/client_type.rb

@@ -16,6 +16,8 @@ module Masks
                 description: "Seconds an access token lasts. Null is an hour."
           field :refresh_token_lifetime, Integer,
                 description: "Seconds a refresh token lasts unused. Each refresh starts it over. Null is 30 days."
+          field :refresh_token_absolute_lifetime, Integer,
+                description: "Seconds from a sign-in until its refresh tokens stop, however often they are used. Null is 90 days."
           field :allowed_groups, [ String ], null: false,
                 description: "Group keys, or organization roles as key:role, whose people may sign in. Empty lets everyone in."
           field :namespaces, [ "Masks::Server::Manage::Types::NamespaceType" ], null: false

data/app/graphql/masks/server/manage/types/query_type.rb

@@ -139,6 +139,9 @@ module Masks
           field :ldap_base_dn, String, null: false, description: "The base DN of this tenant's LDAP directory."
           field :ldap_port, Integer, null: false, description: "The port masks serves LDAP on."
           field :ldap_tls, Boolean, null: false, description: "Whether that port speaks LDAPS."
+          field :ldap_local_only, Boolean, null: false,
+                description: "Whether the directory answers only on the server's own machine, " \
+                             "since it has no certificate and MASKS_LDAP_PLAINTEXT is not set."
           field :saml_metadata_url, String, null: false
 
           field :minimum_password, Integer, null: false
@@ -236,6 +239,10 @@ module Masks
             ::Rails.configuration.masks.ldap_cert.present?
           end
 
+          def ldap_local_only
+            Ldap::Listener.local_only?
+          end
+
           def ldap_base_dn
             Ldap::Directory.base_for(Current.tenant).to_s
           end

data/app/jobs/masks/server/cleanup_job.rb

@@ -33,6 +33,7 @@ module Masks
           Event.where(created_at: ...tenant.event_retention.ago).in_batches(of: BATCH).delete_all
           Members.purge_lapsed!
           Replay.where(expires_at: ...Time.current).in_batches(of: BATCH).delete_all
+          ReleasedNickname.lapsed.in_batches(of: BATCH).delete_all
         end
 
         def sweep_tokens(cutoff)

data/app/ldap/masks/server/ldap/listener.rb

@@ -6,11 +6,24 @@ module Masks
         IDLE = 5.minutes
         HANDSHAKE = 10.seconds
 
-        attr_reader :port
+        EVERY_ADDRESS = "0.0.0.0".freeze
+        THIS_MACHINE = "127.0.0.1".freeze
+
+        attr_reader :host, :port
 
         class << self
           def from_configuration(config = ::Rails.configuration.masks)
-            new(host: "0.0.0.0", port: config.ldap_port, tls: tls(config.ldap_cert, config.ldap_key))
+            tls = tls(config.ldap_cert, config.ldap_key)
+
+            new(host: host_for(tls: tls, plaintext: config.ldap_plaintext), port: config.ldap_port, tls: tls)
+          end
+
+          def host_for(tls:, plaintext:)
+            tls || plaintext ? EVERY_ADDRESS : THIS_MACHINE
+          end
+
+          def local_only?(config = ::Rails.configuration.masks)
+            config.ldap_cert.blank? && !config.ldap_plaintext
           end
 
           def tls(cert, key)
@@ -40,7 +53,7 @@ module Masks
         def start
           @server = TCPServer.new(@host, @wanted_port)
           @port = @server.local_address.ip_port
-          @logger.info("masks ldap: listening on #{@host}:#{@port}#{' with TLS' if @tls}")
+          @logger.info("masks ldap: listening on #{@host}:#{@port}#{' with TLS' if @tls}#{' on this machine only' if @host == THIS_MACHINE}")
           @acceptor = Thread.new { accept_loop }
           self
         end

data/app/logins/masks/server/login_states/confirmation.rb

@@ -23,11 +23,11 @@ module Masks
           resend
         end
 
-        handles "confirm:add-phone" do
+        handles "confirm:add-phone", limit: :sending do
           add_phone
         end
 
-        handles "confirm:change-phone" do
+        handles "confirm:change-phone", limit: :sending do
           change_phone
         end
 
@@ -129,9 +129,15 @@ module Masks
           end
 
           def send_code(channel)
+            @tokens&.delete(channel)
+
+            if ConfirmationCode.crowded?(actor: actor, channel: channel)
+              login.store[HELD] = held.merge("#{channel}_sent" => Time.current.to_i)
+              return warn!(channel == ConfirmationCode::PHONE ? "too-many-texts" : "too-many-codes")
+            end
+
             token = Confirmations.send_code(actor, channel, journey: Masks::Server::Journey.sign_in(login))
 
-            @tokens&.delete(channel)
             login.store[HELD] = held.merge(channel => token.id, "#{channel}_sent" => Time.current.to_i)
           end
 

data/app/logins/masks/server/login_states/signup.rb

@@ -280,6 +280,7 @@ module Masks
 
               now = Time.current
               actor = Masks::Server::Actor.new(
+                trusted_rename: @first_run,
                 nickname: held["nickname"],
                 email: held["email"],
                 name: held["name"],

data/app/models/masks/server/actor.rb

@@ -33,6 +33,9 @@ module Masks
       has_many :groups, through: :group_members
 
       before_destroy :sign_out_everywhere!, prepend: true
+      before_destroy :release_nickname
+
+      attr_accessor :trusted_rename
 
       validates :nickname,
                 uniqueness: { scope: :tenant_id, case_sensitive: false },
@@ -52,8 +55,10 @@ module Masks
                 allow_blank: true
 
       validate :named
+      validate :nickname_free, if: -> { nickname.present? && will_save_change_to_nickname? && !trusted_rename }
 
       before_save :activate_once_a_password_exists
+      after_save :release_previous_nickname, if: :saved_change_to_nickname?
       before_save :forget_code_factors_for_new_addresses
       after_update :forget_mailed_links, if: :saved_change_to_email?
 
@@ -282,11 +287,16 @@ module Masks
 
         held.find_each(&:revoke!)
         RefreshToken.where(actor_id: id).live.find_each(&:revoke!)
+
+        issued = AccessToken.where(actor_id: id).live
+        issued = issued.where.not(session_id: keeping.id) if keeping
+        issued.update_all(consumed_at: Time.current, updated_at: Time.current)
+
         DeviceFactor.forget!(actor: self)
       end
 
       def notified?(action)
-        Notifications.mailed?(action) && !muted_notifications.include?(action.to_s)
+        Notifications.mailed?(action) && (Notifications.always?(action) || !muted_notifications.include?(action.to_s))
       end
 
       def notifications
@@ -294,7 +304,7 @@ module Masks
       end
 
       def notifications=(wanted)
-        self.muted_notifications = Notifications::MAILED - Array(wanted).map(&:to_s)
+        self.muted_notifications = Notifications::MUTABLE - Array(wanted).map(&:to_s)
       end
 
       def otp?
@@ -508,6 +518,19 @@ module Masks
           end
         end
 
+        def nickname_free
+          errors.add(:nickname, :held) if ReleasedNickname.held_from?(nickname, self)
+        end
+
+        def release_previous_nickname
+          ReleasedNickname.where(nickname: nickname.to_s.downcase, actor_id: id).delete_all if nickname.present?
+          ReleasedNickname.release!(nickname_before_last_save, actor: self)
+        end
+
+        def release_nickname
+          ReleasedNickname.release!(nickname, actor: self)
+        end
+
         def manages_by_both
           errors.add(:nickname, :blank) if nickname.blank?
           errors.add(:email, :blank) if email.blank?

data/app/models/masks/server/client.rb

@@ -82,6 +82,8 @@ module Masks
       validate :resources_are_named_only_when_approved
       validates :access_token_lifetime, numericality: { only_integer: true, in: 60..1.day.to_i }, allow_nil: true
       validates :refresh_token_lifetime, numericality: { only_integer: true, in: 5.minutes.to_i..400.days.to_i }, allow_nil: true
+      validates :refresh_token_absolute_lifetime, numericality: { only_integer: true, in: 5.minutes.to_i..400.days.to_i },
+                                                  allow_nil: true
       validates :consent_lifetime, numericality: { only_integer: true, greater_than_or_equal_to: 300,
                                                    less_than_or_equal_to: Consent::LONGEST.to_i }, allow_nil: true
 
@@ -377,6 +379,11 @@ module Masks
 
       def authenticate_secret(candidate)
         return true if public?
+
+        secret_matches?(candidate) && !secret_expired?
+      end
+
+      def secret_matches?(candidate)
         return false unless secret?
         return false if secret_digest.blank? || candidate.blank?
 
@@ -385,6 +392,10 @@ module Masks
         false
       end
 
+      def secret_expired?
+        secret_expires_at.present? && secret_expires_at.past?
+      end
+
       def redirect_uri?(candidate)
         redirect_uris.include?(candidate.to_s) || redirect_uris.any? { |registered| same_loopback?(registered, candidate.to_s) }
       end
@@ -445,6 +456,10 @@ module Masks
         refresh_token_lifetime&.seconds || RefreshToken.lifetime
       end
 
+      def refresh_absolute_lifetime
+        refresh_token_absolute_lifetime&.seconds || RefreshToken.absolute_lifetime
+      end
+
       def admits?(actor)
         allowed_groups.empty? || actor.group_labels.intersect?(allowed_groups)
       end

data/app/models/masks/server/client_keys.rb

@@ -78,7 +78,7 @@ module Masks
         raise Refused, "#{algorithm.presence || 'that'} is not an algorithm #{subject} may be signed with" unless ALGORITHMS.include?(algorithm)
 
         verified = attempt(token, header, algorithm, fresh: false)
-        verified ||= attempt(token, header, algorithm, fresh: true) if remote? && unknown_kid?(header)
+        verified ||= attempt(token, header, algorithm, fresh: true) if remote? && unknown_kid?(header) && refetch_open?
 
         verified || raise(Refused, "#{subject} was not signed by a key this client registered")
       rescue JWT::DecodeError
@@ -127,9 +127,20 @@ module Masks
           kid ? held.select { |jwk| jwk["kid"] == kid } : held
         end
 
+        def refetch_open?
+          return false if ::Rails.cache.exist?(refetched_key)
+
+          ::Rails.cache.write(refetched_key, Time.current.to_i, expires_in: LIFETIME)
+          true
+        end
+
         def cache_key
           "client-jwks:#{client.tenant_id}:#{client.id}:#{Digest::SHA256.hexdigest(client.jwks_uri.to_s)}"
         end
+
+        def refetched_key
+          "#{cache_key}:refetched"
+        end
     end
   end
 end

data/app/models/masks/server/declared.rb

@@ -5,7 +5,7 @@ module Masks
 
       TENANT_KEYS = %w[name accent_color groups apps].freeze
       APP_KEYS = %w[preset url slug name client_id client_secret_env redirect_uris scopes allowed_groups
-                    access_token_lifetime refresh_token_lifetime].freeze
+                    access_token_lifetime refresh_token_lifetime refresh_token_absolute_lifetime].freeze
 
       def self.apply!(path = ::Rails.configuration.masks.config_path)
         return [] if path.blank?
@@ -92,6 +92,7 @@ module Masks
             allowed_groups: Array(declared["allowed_groups"]),
             access_token_lifetime: declared["access_token_lifetime"],
             refresh_token_lifetime: declared["refresh_token_lifetime"],
+            refresh_token_absolute_lifetime: declared["refresh_token_absolute_lifetime"],
             consent_required: false
           }
 

data/app/models/masks/server/event.rb

@@ -18,6 +18,7 @@ module Masks
 
       ACCOUNT_CREATED = "account.created".freeze
       ACCOUNT_EXPORTED = "account.exported".freeze
+      NOTIFICATIONS_CHANGED = "notifications.changed".freeze
       INVITATION_SENT = "invitation.sent".freeze
       INVITATION_ACCEPTED = "invitation.accepted".freeze
 

data/app/models/masks/server/notifications.rb

@@ -51,6 +51,10 @@ module Masks
 
       MAILED = GROUPS.values.flatten.freeze
 
+      ALWAYS = [ Event::PASSWORD_CHANGED, Event::PASSWORD_RESET_COMPLETED, Event::SIGN_IN_RISKY ].freeze
+
+      MUTABLE = (MAILED - ALWAYS).freeze
+
       ONCE_PER_DEVICE = [ Event::SESSION_STARTED ].freeze
 
       class << self
@@ -58,6 +62,10 @@ module Masks
           MAILED.include?(action.to_s)
         end
 
+        def always?(action)
+          ALWAYS.include?(action.to_s)
+        end
+
         def raised(event)
           return false unless mailed?(event.action) || WARNS_PREVIOUS.include?(event.action)
           return false unless event.actor_id && ActorMailer.deliverable?

data/app/models/masks/server/pending_request.rb

@@ -39,6 +39,14 @@ module Masks
         held("max_age")
       end
 
+      def refuse!(error, description)
+        update!(payload: (payload || {}).merge("refusal" => { "error" => error, "description" => description }))
+      end
+
+      def refusal
+        held("refusal")
+      end
+
       def issue_code!(actor:, device: nil, session: nil, authenticated_at: nil, amr: nil, organization: nil)
         AuthorizationCode.mint!(
           organization: organization,