masks-server 0.9.0 → 0.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 36e33f34e755bbbb4470a5c55b920624f2042678b87c810ce614e86f9638a4df
-  data.tar.gz: 2bf178807ba578015922b44145ad0eb28454698adb877ac51b5059be57a35ca3
+  metadata.gz: 608910b5ec386933423f04a3596c4b5d454b38e956449ca66d762d2cd79e3e82
+  data.tar.gz: f70b574939800fdcb3407025402e39663e15f8a9c71e2dff473685147e7cf693
 SHA512:
-  metadata.gz: 3d32dd6592c56c0132971c1f322ca90b2a31df6832c0b9fe33d5c41c7d5d7aab443b4c6b2fec0a9d3ac0635b22b6d86bbda1c451bd791fd3794e4776c1edd1c8
-  data.tar.gz: 59f5658c277590947cf74f3b8e57fe2d9d7b01f1a160bdc3bdbc3593f4aba9b9395b08255b866e54029f48aff6d9b7b1384daf9ab1b21b95f7468678a800fbcb
+  metadata.gz: a061d6d81ac514d825d3963c466e99272d224e0250e964e8a057a8e794a7cd1f26955cd8e1cb5753eb418f8c91e5dd2d9b31b98c8bba4eb97d11d7112ce0a40b
+  data.tar.gz: c537d6afb5fc139d5e83fd92143f0eb28588f9ec1992e607209f89c5c9f59dfff3502dc0f1196a39c2a19fcec67910458494324a70e739ced310ea73f69168cb

data/app/controllers/concerns/masks/server/client_authentication.rb

@@ -16,9 +16,10 @@ module Masks
           client_refused!("no client is registered with that client_id") if client.nil?
           client_refused!("this client authenticates with a signed assertion, not a secret") if client.asserts?
 
-          client_refused! unless client.authenticate_secret(secret)
+          return client if client.authenticate_secret(secret)
 
-          client
+          client_refused!("this client's secret expired on #{client.secret_expires_at.iso8601}, and a manager rotates it") if client.secret_expired? && client.secret_matches?(secret)
+          client_refused!
         end
 
         def asserted_client(assertion)

data/app/controllers/masks/server/addresses_controller.rb

@@ -8,6 +8,7 @@ module Masks
                  only: :update
 
       before_action :require_actor
+      before_action :known_channel
       before_action -> { reauthenticated!(anchor, t("addresses.again")) }
       before_action :refuse_directed
 
@@ -55,7 +56,11 @@ module Masks
       private
 
         def channel
-          params[:channel].to_s
+          @channel ||= Addresses::CHANNELS.keys.find { |known| known == params[:channel].to_s }
+        end
+
+        def known_channel
+          head :not_found if channel.nil?
         end
 
         def anchor

data/app/controllers/masks/server/application_controller.rb

@@ -264,6 +264,34 @@ module Masks
           )
         end
 
+        def answerable?(pending)
+          authorization = pending.authorization
+
+          authorization.client&.approved? || ours?(authorization.redirect_uri)
+        end
+
+        def refuse_on_masks(pending, refusal)
+          pending.refuse!(refusal.error, refusal.description)
+          PendingRequest.claim(rid_for(pending))
+
+          authorize_refused_path(rid: rid_for(pending))
+        end
+
+        def refused_request(rid)
+          return nil if rid.blank? || !tracked(REQUESTS).value?(rid)
+
+          PendingRequest.spent(rid)&.then { |held| held if held.consumed? }
+        end
+
+        def ours?(target)
+          here = URI.parse(issuer.url)
+          there = URI.parse(target.to_s)
+
+          there.scheme == here.scheme && there.host == here.host && there.port == here.port
+        rescue URI::InvalidURIError
+          false
+        end
+
         def authorize_url_for(pending)
           "#{authorize_path}?#{URI.encode_www_form(pending.authorization.query_pairs)}"
         end
@@ -303,7 +331,7 @@ module Masks
 
         def settle!(login)
           hold(login.actor, amr: login.amr, policy: login.policy, first_factor: login.first_factored_by,
-                            authenticated_at: login.factored_at(:first_factor))
+                            authenticated_at: login.authenticated_at)
           forget_login
         end
 

data/app/controllers/masks/server/authorize_controller.rb

@@ -45,6 +45,7 @@ module Masks
 
         login = advance(pending)
 
+        return redirect_to(refuse_on_masks(pending, login.refusal)) if login.refused? && !answerable?(pending)
         return answer(deny(pending, login.refusal.error, login.refusal.description)) if login.refused?
         return interaction_required(pending) if login.prompted? && pending.silent?
         return redirect_to(login.redirect_to, allow_other_host: true) if login.redirect_to.present?
@@ -53,6 +54,15 @@ module Masks
         complete(pending, attempt, login)
       end
 
+      def refused
+        refusal = refused_request(params[:rid])&.refusal
+
+        return show_error("invalid_request", "that sign-in request has expired", :bad_request) if refusal.nil?
+
+        @refused = true
+        show_error(refusal["error"], refusal["description"], :forbidden)
+      end
+
       private
 
         def validate(authorization)
@@ -66,6 +76,7 @@ module Masks
             req.verify_redirect_uri!(client.redirect_uri?(req.redirect_uri) ? [ req.redirect_uri.to_s ] : client.redirect_uris)
             req.verified_redirect_uri = with_issuer(req.verified_redirect_uri)
             res.redirect_uri = req.verified_redirect_uri
+            req.verified_redirect_uri = nil unless hears_errors?(client, req.redirect_uri)
 
             permit(req) { authorization.validate! }
           end
@@ -97,7 +108,7 @@ module Masks
             actor: current_actor,
             device: current_device,
             session: current_session,
-            authenticated_at: login.authenticated_at || current_session&.authenticated_at,
+            authenticated_at: current_session&.authenticated_at,
             amr: login.amr.presence || current_session&.amr,
             organization: login.state("organization-choice").selected
           )
@@ -121,21 +132,20 @@ module Masks
           client = Client.authenticating(params[:client_id])
           target = params[:redirect_uri].to_s
 
-          if target.present? && (client&.redirect_uri?(target) || ours?(target))
+          if target.present? && hears_errors?(client, target)
             return redirect_to refusal_uri(target, error), allow_other_host: true
           end
 
-          @error_code = error.error.to_s
-          @error_description = error.description
+          show_error(error.error.to_s, error.description, error.status)
+        end
+
+        def show_error(code, description, status)
+          @error_code = code
+          @error_description = description
 
           respond_to do |format|
-            format.html { render :error, status: error.status }
-            format.any do
-              render json: {
-                "error" => @error_code,
-                "error_description" => @error_description
-              }, status: error.status
-            end
+            format.html { render :error, status: status }
+            format.any { render json: { "error" => code, "error_description" => description }, status: status }
           end
         end
 
@@ -163,13 +173,8 @@ module Masks
           Rack::OAuth2::Server::Authorize::BadRequest.new(error, description)
         end
 
-        def ours?(target)
-          here = URI.parse(issuer.url)
-          there = URI.parse(target.to_s)
-
-          there.scheme == here.scheme && there.host == here.host && there.port == here.port
-        rescue URI::InvalidURIError
-          false
+        def hears_errors?(client, target)
+          ours?(target) || (client.present? && client.approved? && client.redirect_uri?(target))
         end
 
         def refusal_uri(target, error)

data/app/controllers/masks/server/device_verifications_controller.rb

@@ -59,7 +59,7 @@ module Masks
             actor: current_actor,
             session: current_session,
             device: current_device,
-            authenticated_at: login.authenticated_at || current_session&.authenticated_at,
+            authenticated_at: current_session&.authenticated_at,
             amr: login.amr.presence || current_session&.amr,
             organization: login.state("organization-choice").selected
           )

data/app/controllers/masks/server/discovery_controller.rb

@@ -1,6 +1,9 @@
 module Masks
   module Server
     class DiscoveryController < ApplicationController
+      OPENID_ISSUER = "http://openid.net/specs/connect/1.0/issuer".freeze
+      LONGEST_RESOURCE = 512
+
       def openid
         render json: issuer.discovery
       end
@@ -13,6 +16,39 @@ module Masks
       def resource
         render json: issuer.protected_resource
       end
+
+      def webfinger
+        resource = params[:resource].to_s
+        host = resource_host(resource)
+
+        return head(:bad_request) if host.nil?
+        return head(:not_found) unless host.casecmp?(URI.parse(issuer.url).host)
+
+        asked = Array(params[:rel]).map(&:to_s)
+        links = [ { "rel" => OPENID_ISSUER, "href" => issuer.url } ]
+        links = links.select { |link| asked.include?(link["rel"]) } if asked.any?
+
+        response.headers["Access-Control-Allow-Origin"] = "*"
+        render json: { "subject" => resource, "links" => links }, content_type: "application/jrd+json"
+      end
+
+      private
+
+        def resource_host(resource)
+          return nil if resource.blank? || resource.length > LONGEST_RESOURCE
+
+          if resource.start_with?("acct:")
+            account, separator, host = resource.delete_prefix("acct:").rpartition("@")
+
+            return nil if separator.empty? || account.blank? || host.blank? || host.match?(%r{[/\\\s?#]})
+
+            host.sub(/:\d+\z/, "")
+          elsif resource.match?(%r{\Ahttps?://})
+            URI.parse(resource).host
+          end
+        rescue URI::InvalidURIError
+          nil
+        end
     end
   end
 end

data/app/controllers/masks/server/enrollments_controller.rb

@@ -12,6 +12,15 @@ module Masks
                    }, status: :too_many_requests
                  }
 
+      rate_limit to: 60, within: 1.hour, only: :create, name: "app",
+                 by: -> { [ current_tenant.id, claimed_client_id ].join(":") },
+                 with: -> {
+                   render json: {
+                     "error" => "too_many_requests",
+                     "error_description" => "too many enrollment tokens asked for by this app"
+                   }, status: :too_many_requests
+                 }
+
       before_action :no_store!
 
       def create
@@ -55,6 +64,14 @@ module Masks
           client
         end
 
+        def claimed_client_id
+          basic = ActionController::HttpAuthentication::Basic
+
+          named, = basic.user_name_and_password(request) if basic.has_basic_credentials?(request)
+
+          (named.presence || params[:client_id]).to_s
+        end
+
         def not_enrolled
           render json: {
             "error" => "invalid_request",

data/app/controllers/masks/server/logins_controller.rb

@@ -152,7 +152,7 @@ module Masks
 
           if login.touched?(:first_factor)
             sign_in(login.actor, amr: login.amr, policy: login.policy, first_factor: login.first_factored_by,
-                                 authenticated_at: login.factored_at(:first_factor))
+                                 authenticated_at: login.authenticated_at)
           elsif login.signed_in? && login.touched?(:second_factor)
             current_session.update!(amr: Array(current_session.amr) | login.amr)
           end
@@ -191,6 +191,7 @@ module Masks
           return refuse_device(pending) if login.refused? && pending&.device?
           return refuse_saml(pending) if login.refused? && pending&.saml?
           return saml_resume_path(rid: rid_for(pending)) if pending&.saml?
+          return refuse_on_masks(pending, login.refusal) if login.refused? && pending && !answerable?(pending)
           return deny(pending, login.refusal.error, login.refusal.description) if login.refused? && pending
           return device_url_for(pending) if pending&.device?
           return authorize_url_for(pending) if pending

data/app/controllers/masks/server/notifications_controller.rb

@@ -2,9 +2,19 @@ module Masks
   module Server
     class NotificationsController < ApplicationController
       before_action :require_actor
+      before_action -> { reauthenticated!("notifications", t("notifications.again")) }
 
       def update
+        was = current_actor.muted_notifications
         current_actor.update!(notifications: wanted)
+        now = current_actor.muted_notifications
+
+        muted = now - was
+        unmuted = was - now
+
+        if muted.any? || unmuted.any?
+          Event.record!(Event::NOTIFICATIONS_CHANGED, actor: current_actor, muted: muted, unmuted: unmuted)
+        end
 
         redirect_to "#{root_path}#notifications", notice: t("notifications.saved")
       end
@@ -12,7 +22,7 @@ module Masks
       private
 
         def wanted
-          Array(params[:notifications]).map(&:to_s) & Notifications::MAILED
+          Array(params[:notifications]).map(&:to_s) & Notifications::MUTABLE
         end
 
         def require_actor

data/app/controllers/masks/server/organization_members_controller.rb

@@ -99,7 +99,9 @@ module Masks
         end
 
         def member!
-          @organization.memberships.includes(:actor).find_by(id: params[:id].to_s) ||
+          membership_id = params[:id].to_s[/\A\d+\z/]
+
+          (membership_id && @organization.memberships.includes(:actor).find_by(id: membership_id)) ||
             raise(Members::Refused, t("organization_members.not_a_member"))
         end
 

data/app/controllers/masks/server/profiles_controller.rb

@@ -5,6 +5,7 @@ module Masks
 
       def update
         return refuse(t("profiles.directed")) if current_actor.directed?
+        return unless kept_nickname? || reauthenticated!("profile", t("profiles.again"))
 
         current_actor.assign_attributes(profile)
         changed = current_actor.changed
@@ -22,6 +23,10 @@ module Masks
           params.permit(:name, :nickname).to_h.transform_values { |value| value.strip.presence }
         end
 
+        def kept_nickname?
+          !profile.key?("nickname") || profile["nickname"] == current_actor.nickname
+        end
+
         def require_actor
           redirect_to login_path unless current_actor
         end

data/app/controllers/masks/server/saml_controller.rb

@@ -139,7 +139,7 @@ module Masks
           assertion = response_for(pending)
           encoded = assertion.success(
             actor: current_actor, session: current_session, name_id_format: saml["name_id_format"], scopes: scopes,
-            authenticated_at: login.authenticated_at || current_session&.authenticated_at,
+            authenticated_at: current_session&.authenticated_at,
             amr: login.amr.presence || current_session&.amr
           )
 
@@ -174,12 +174,6 @@ module Masks
           )
         end
 
-        def refused_request(rid)
-          return nil if rid.blank? || !tracked(REQUESTS).value?(rid)
-
-          PendingRequest.spent(rid)&.then { |held| held if held.consumed? }
-        end
-
         def post(pending, encoded)
           post_saml(pending.client, pending.redirect_uri, "SAMLResponse", encoded, relay_state: pending.held("saml")["relay_state"])
         end

data/app/controllers/masks/server/tokens_controller.rb

@@ -124,6 +124,7 @@ module Masks
 
           req.invalid_grant!("that refresh token was issued to another client") if token.client_id != client.id
           req.invalid_grant!("the session that refresh token was issued in has ended") if outlived?(token)
+          exhausted!(req, token, client)
           member!(req, token)
           consented!(req, token, client)
           Current.organization = token.organization
@@ -180,6 +181,13 @@ module Masks
           held.present? && held.bounded? && !held.live?
         end
 
+        def exhausted!(req, token, client)
+          return unless token.exhausted?(client.refresh_absolute_lifetime)
+
+          token.revoke_family!
+          req.invalid_grant!("the sign-in behind that refresh token is older than #{client.name} allows")
+        end
+
         def replayed!(spent, client)
           return if spent.nil? || !spent.consumed?
 

data/app/graphql/masks/server/manage/mutations/create_actor.rb

@@ -18,6 +18,7 @@ module Masks
             granting!(scopes)
 
             actor = Actor.new(
+              trusted_rename: true,
               nickname: nickname,
               email: email,
               scopes: Scopes.join(Scopes.list(scopes).presence || Scopes::STANDARD)

data/app/graphql/masks/server/manage/mutations/unenroll_client.rb

@@ -0,0 +1,28 @@
+module Masks
+  module Server
+    module Manage
+      module Mutations
+        class UnenrollClient < BaseMutation
+          requires :security
+
+          argument :client_id, ID
+
+          field :client, Types::ClientType, null: false
+
+          def resolve(client_id:)
+            machine = client!(client_id)
+
+            refuse!("that client is not a machine an app enrolled, so archive it instead") unless machine.enrolled?
+
+            revoked = machine.unenroll!
+
+            audit!(Masks::Server::Event::CLIENT_UNENROLLED, client: machine, name: machine.name,
+                                                             enrolled_by: machine.enrolled_by.client_id, revoked: revoked)
+
+            { client: machine }
+          end
+        end
+      end
+    end
+  end
+end

data/app/graphql/masks/server/manage/mutations/update_actor.rb

@@ -29,6 +29,7 @@ module Masks
             needs!(:security, "changing someone's email address") if changing_email
             previous = actor.email if changing_email && actor.email_verified_at.present?
 
+            actor.trusted_rename = true
             actor.assign_attributes(attributes)
             actor.email_verified_at = nil if changing_email
             actor.phone_verified_at = nil if attributes.key?(:phone) && actor.phone_changed?

data/app/graphql/masks/server/manage/mutations/update_client.rb

@@ -36,6 +36,9 @@ module Masks
                    description: "Seconds an access token lasts, from 60 to a day. Zero goes back to an hour."
           argument :refresh_token_lifetime, Integer, required: false,
                    description: "Seconds a refresh token lasts unused, from 300 to 400 days. Zero goes back to 30 days."
+          argument :refresh_token_absolute_lifetime, Integer, required: false,
+                   description: "Seconds from a sign-in until its refresh tokens stop, however often they are used, " \
+                                "from 300 to 400 days. Zero goes back to 90 days."
           argument :allowed_groups, [ String ], required: false,
                    description: "Group keys, or organization roles as key:role, whose people may sign in to this client. Empty lets everyone in."
           argument :sign_in_policy, ID, required: false
@@ -68,6 +71,7 @@ module Masks
             attributes[:consent_lifetime] = nil if attributes[:consent_lifetime]&.zero?
             attributes[:access_token_lifetime] = nil if attributes[:access_token_lifetime]&.zero?
             attributes[:refresh_token_lifetime] = nil if attributes[:refresh_token_lifetime]&.zero?
+            attributes[:refresh_token_absolute_lifetime] = nil if attributes[:refresh_token_absolute_lifetime]&.zero?
             client.assign_attributes(attributes)
             client.response_types = client.default_response_types if attributes.key?(:grant_types)
             client.required_scopes = Scopes.join(required_scopes) unless required_scopes.nil?

data/app/graphql/masks/server/manage/types/client_type.rb

@@ -16,6 +16,8 @@ module Masks
                 description: "Seconds an access token lasts. Null is an hour."
           field :refresh_token_lifetime, Integer,
                 description: "Seconds a refresh token lasts unused. Each refresh starts it over. Null is 30 days."
+          field :refresh_token_absolute_lifetime, Integer,
+                description: "Seconds from a sign-in until its refresh tokens stop, however often they are used. Null is 90 days."
           field :allowed_groups, [ String ], null: false,
                 description: "Group keys, or organization roles as key:role, whose people may sign in. Empty lets everyone in."
           field :namespaces, [ "Masks::Server::Manage::Types::NamespaceType" ], null: false
@@ -61,6 +63,8 @@ module Masks
                 description: "The app that enrolled this client as one of its machines. Archiving that app archives this client."
           field :enrolled, [ ClientType ], null: false,
                 description: "The machines this app enrolled that are not archived."
+          field :last_seen_at, GraphQL::Types::ISO8601DateTime,
+                description: "When this client last got a token. Null if it never has."
           field :archived_at, GraphQL::Types::ISO8601DateTime
           field :secret_expires_at, GraphQL::Types::ISO8601DateTime
           field :created_at, GraphQL::Types::ISO8601DateTime, null: false
@@ -83,6 +87,10 @@ module Masks
             object.enrolled.active.order(:name)
           end
 
+          def last_seen_at
+            Masks::Server::Token.where(kind: TokenType::GRANTS, client_id: object.id).maximum(:created_at)
+          end
+
           def tokens(limit: nil)
             Masks::Server::Token.where(kind: TokenType::GRANTS, client_id: object.id)
                    .live

data/app/graphql/masks/server/manage/types/mutation_type.rb

@@ -41,6 +41,7 @@ module Masks
           field :update_client, mutation: Mutations::UpdateClient
           field :rotate_client_secret, mutation: Mutations::RotateClientSecret
           field :archive_client, mutation: Mutations::ArchiveClient
+          field :unenroll_client, mutation: Mutations::UnenrollClient
           field :restore_client, mutation: Mutations::RestoreClient
           field :release_namespace, mutation: Mutations::ReleaseNamespace
           field :discover_provider, mutation: Mutations::DiscoverProvider

data/app/graphql/masks/server/manage/types/query_type.rb

@@ -139,6 +139,9 @@ module Masks
           field :ldap_base_dn, String, null: false, description: "The base DN of this tenant's LDAP directory."
           field :ldap_port, Integer, null: false, description: "The port masks serves LDAP on."
           field :ldap_tls, Boolean, null: false, description: "Whether that port speaks LDAPS."
+          field :ldap_local_only, Boolean, null: false,
+                description: "Whether the directory answers only on the server's own machine, " \
+                             "since it has no certificate and MASKS_LDAP_PLAINTEXT is not set."
           field :saml_metadata_url, String, null: false
 
           field :minimum_password, Integer, null: false
@@ -236,6 +239,10 @@ module Masks
             ::Rails.configuration.masks.ldap_cert.present?
           end
 
+          def ldap_local_only
+            Ldap::Listener.local_only?
+          end
+
           def ldap_base_dn
             Ldap::Directory.base_for(Current.tenant).to_s
           end

data/app/jobs/masks/server/application_job.rb

@@ -2,6 +2,34 @@ module Masks
   module Server
     class ApplicationJob < ActiveJob::Base
       include Tenancy::Job
+
+      class Incomplete < StandardError; end
+
+      private
+
+        def each_tenant(scope = Tenant.active)
+          failed = scope.find_each.filter_map do |tenant|
+            Tenant.switch(tenant) { yield tenant }
+            nil
+          rescue StandardError => e
+            report_tenant_failure(tenant, e)
+            tenant.subdomain
+          end
+
+          JobFailures.record(self.class.name, failed)
+
+          raise Incomplete, "#{self.class.name.demodulize} failed for #{failed.join(', ')}" if failed.any?
+        end
+
+        def report_tenant_failure(tenant, error)
+          ::Rails.error.report(error, context: { tenant: tenant.subdomain, job: self.class.name })
+
+          Tenant.switch(tenant) do
+            Event.record!(Event::JOB_FAILED, by: nil, job: self.class.name.demodulize, error: error.class.name, message: error.message.to_s[0, 200])
+          end
+        rescue StandardError => e
+          ::Rails.logger.warn("#{self.class.name} could not record its failure in #{tenant.subdomain}: #{e.message}")
+        end
     end
   end
 end

data/app/jobs/masks/server/check_domain_claims_job.rb

@@ -5,9 +5,7 @@ module Masks
       across_tenants!
 
       def perform
-        Tenant.active.find_each do |tenant|
-          Tenant.switch(tenant) { check }
-        end
+        each_tenant { check }
       end
 
       private

data/app/jobs/masks/server/cleanup_job.rb

@@ -33,16 +33,15 @@ module Masks
           Event.where(created_at: ...tenant.event_retention.ago).in_batches(of: BATCH).delete_all
           Members.purge_lapsed!
           Replay.where(expires_at: ...Time.current).in_batches(of: BATCH).delete_all
+          ReleasedNickname.lapsed.in_batches(of: BATCH).delete_all
         end
 
         def sweep_tokens(cutoff)
-          loop do
-            roots = Token.group("COALESCE(root_id, id)")
-              .having("MAX(LEAST(consumed_at, expires_at)) < ?", cutoff)
-              .limit(BATCH).pluck(Arel.sql("COALESCE(root_id, id)"))
-            break if roots.empty?
+          Token.where(root_id: nil).ended_before(cutoff).in_batches(of: BATCH) do |roots|
+            ids = roots.pluck(:id)
+            kept = Token.where(root_id: ids).where("LEAST(consumed_at, expires_at) >= ?", cutoff).distinct.pluck(:root_id)
 
-            Token.families(roots).delete_all
+            Token.families(ids - kept).delete_all
           end
 
           Token.where.not(kind: RefreshToken.sti_name).ended_before(cutoff)

data/app/jobs/masks/server/idle_accounts_job.rb

@@ -5,9 +5,7 @@ module Masks
       across_tenants!
 
       def perform
-        Tenant.active.idling.find_each do |tenant|
-          Tenant.switch(tenant) { IdleAccounts.sweep(tenant) }
-        end
+        each_tenant(Tenant.active.idling) { |tenant| IdleAccounts.sweep(tenant) }
       end
     end
   end

data/app/jobs/masks/server/prune_queue_job.rb

@@ -0,0 +1,19 @@
+module Masks
+  module Server
+    class PruneQueueJob < ApplicationJob
+      queue_as :maintenance
+      across_tenants!
+
+      BATCH = 500
+
+      def perform
+        return unless defined?(::SolidQueue::Job)
+
+        settings = ::Rails.configuration.masks
+
+        ::SolidQueue::Job.clear_finished_in_batches(batch_size: BATCH, finished_before: settings.finished_job_retention.ago)
+        ::SolidQueue::FailedExecution.where(created_at: ...settings.failed_job_retention.ago).discard_all_in_batches(batch_size: BATCH)
+      end
+    end
+  end
+end

data/app/jobs/masks/server/refresh_saml_metadata_job.rb

@@ -5,9 +5,7 @@ module Masks
       across_tenants!
 
       def perform
-        Tenant.active.find_each do |tenant|
-          Tenant.switch(tenant) { refresh }
-        end
+        each_tenant { refresh }
       end
 
       private

data/app/jobs/masks/server/rotate_signing_keys_job.rb

@@ -7,9 +7,7 @@ module Masks
       PUBLISHED_FOR = 1.day
 
       def perform
-        Tenant.active.where.not(key_rotation_days: nil).find_each do |tenant|
-          Tenant.switch(tenant) { advance(tenant) }
-        end
+        each_tenant(Tenant.active.where.not(key_rotation_days: nil)) { |tenant| advance(tenant) }
       end
 
       private