masks-server 0.9.0 → 0.11.0

data/app/jobs/masks/server/text_job.rb

@@ -3,7 +3,11 @@ module Masks
     class TextJob < ApplicationJob
       queue_as :mailers
 
-      retry_on Sender::Failed, wait: :polynomially_longer, attempts: 3
+      ATTEMPTS = 3
+
+      retry_on Sender::Failed, wait: :polynomially_longer, attempts: ATTEMPTS do |job, error|
+        job.gave_up!(error)
+      end
 
       def perform(to, body)
         sender = Current.tenant&.sms_sender
@@ -12,6 +16,13 @@ module Masks
 
         sender.deliver(to: to, body: body)
       end
+
+      def gave_up!(error)
+        Tenant.switch(held_tenant) do
+          Event.record!(Event::TEXT_UNDELIVERED, actor: nil, by: nil, device: nil, ip_address: nil, user_agent: nil,
+                                                 said: error.message)
+        end
+      end
     end
   end
 end

data/app/ldap/masks/server/ldap/listener.rb

@@ -6,11 +6,24 @@ module Masks
         IDLE = 5.minutes
         HANDSHAKE = 10.seconds
 
-        attr_reader :port
+        EVERY_ADDRESS = "0.0.0.0".freeze
+        THIS_MACHINE = "127.0.0.1".freeze
+
+        attr_reader :host, :port
 
         class << self
           def from_configuration(config = ::Rails.configuration.masks)
-            new(host: "0.0.0.0", port: config.ldap_port, tls: tls(config.ldap_cert, config.ldap_key))
+            tls = tls(config.ldap_cert, config.ldap_key)
+
+            new(host: host_for(tls: tls, plaintext: config.ldap_plaintext), port: config.ldap_port, tls: tls)
+          end
+
+          def host_for(tls:, plaintext:)
+            tls || plaintext ? EVERY_ADDRESS : THIS_MACHINE
+          end
+
+          def local_only?(config = ::Rails.configuration.masks)
+            config.ldap_cert.blank? && !config.ldap_plaintext
           end
 
           def tls(cert, key)
@@ -40,7 +53,7 @@ module Masks
         def start
           @server = TCPServer.new(@host, @wanted_port)
           @port = @server.local_address.ip_port
-          @logger.info("masks ldap: listening on #{@host}:#{@port}#{' with TLS' if @tls}")
+          @logger.info("masks ldap: listening on #{@host}:#{@port}#{' with TLS' if @tls}#{' on this machine only' if @host == THIS_MACHINE}")
           @acceptor = Thread.new { accept_loop }
           self
         end

data/app/logins/masks/server/login_states/confirmation.rb

@@ -23,11 +23,11 @@ module Masks
           resend
         end
 
-        handles "confirm:add-phone" do
+        handles "confirm:add-phone", limit: :sending do
           add_phone
         end
 
-        handles "confirm:change-phone" do
+        handles "confirm:change-phone", limit: :sending do
           change_phone
         end
 
@@ -129,9 +129,15 @@ module Masks
           end
 
           def send_code(channel)
+            @tokens&.delete(channel)
+
+            if ConfirmationCode.crowded?(actor: actor, channel: channel)
+              login.store[HELD] = held.merge("#{channel}_sent" => Time.current.to_i)
+              return warn!(channel == ConfirmationCode::PHONE ? "too-many-texts" : "too-many-codes")
+            end
+
             token = Confirmations.send_code(actor, channel, journey: Masks::Server::Journey.sign_in(login))
 
-            @tokens&.delete(channel)
             login.store[HELD] = held.merge(channel => token.id, "#{channel}_sent" => Time.current.to_i)
           end
 

data/app/logins/masks/server/login_states/signup.rb

@@ -280,6 +280,7 @@ module Masks
 
               now = Time.current
               actor = Masks::Server::Actor.new(
+                trusted_rename: @first_run,
                 nickname: held["nickname"],
                 email: held["email"],
                 name: held["name"],

data/app/models/masks/server/actor.rb

@@ -33,6 +33,9 @@ module Masks
       has_many :groups, through: :group_members
 
       before_destroy :sign_out_everywhere!, prepend: true
+      before_destroy :release_nickname
+
+      attr_accessor :trusted_rename
 
       validates :nickname,
                 uniqueness: { scope: :tenant_id, case_sensitive: false },
@@ -52,8 +55,10 @@ module Masks
                 allow_blank: true
 
       validate :named
+      validate :nickname_free, if: -> { nickname.present? && will_save_change_to_nickname? && !trusted_rename }
 
       before_save :activate_once_a_password_exists
+      after_save :release_previous_nickname, if: :saved_change_to_nickname?
       before_save :forget_code_factors_for_new_addresses
       after_update :forget_mailed_links, if: :saved_change_to_email?
 
@@ -282,11 +287,16 @@ module Masks
 
         held.find_each(&:revoke!)
         RefreshToken.where(actor_id: id).live.find_each(&:revoke!)
+
+        issued = AccessToken.where(actor_id: id).live
+        issued = issued.where.not(session_id: keeping.id) if keeping
+        issued.update_all(consumed_at: Time.current, updated_at: Time.current)
+
         DeviceFactor.forget!(actor: self)
       end
 
       def notified?(action)
-        Notifications.mailed?(action) && !muted_notifications.include?(action.to_s)
+        Notifications.mailed?(action) && (Notifications.always?(action) || !muted_notifications.include?(action.to_s))
       end
 
       def notifications
@@ -294,7 +304,7 @@ module Masks
       end
 
       def notifications=(wanted)
-        self.muted_notifications = Notifications::MAILED - Array(wanted).map(&:to_s)
+        self.muted_notifications = Notifications::MUTABLE - Array(wanted).map(&:to_s)
       end
 
       def otp?
@@ -508,6 +518,19 @@ module Masks
           end
         end
 
+        def nickname_free
+          errors.add(:nickname, :held) if ReleasedNickname.held_from?(nickname, self)
+        end
+
+        def release_previous_nickname
+          ReleasedNickname.where(nickname: nickname.to_s.downcase, actor_id: id).delete_all if nickname.present?
+          ReleasedNickname.release!(nickname_before_last_save, actor: self)
+        end
+
+        def release_nickname
+          ReleasedNickname.release!(nickname, actor: self)
+        end
+
         def manages_by_both
           errors.add(:nickname, :blank) if nickname.blank?
           errors.add(:email, :blank) if email.blank?

data/app/models/masks/server/app_preset.rb

@@ -182,6 +182,108 @@ module Masks
             [ "OAUTH_PROVIDER_NAME", "{tenant}" ], [ "ENABLE_OAUTH_SIGNUP", "true" ],
             [ "ENABLE_OAUTH_ROLE_MANAGEMENT", "true" ], [ "OAUTH_ROLES_CLAIM", "groups" ], [ "OAUTH_ADMIN_ROLES", "admins" ]
           ]
+        },
+        {
+          key: "tailscale", name: "Tailscale",
+          redirects: [ "https://login.tailscale.com/a/oauth_response" ],
+          scopes: %w[openid profile email],
+          guide: "https://tailscale.com/kb/1240/sso-custom-oidc",
+          settings: [
+            [ "WebFinger domain", "{masks_host}" ], [ "Issuer URL", "{issuer}" ],
+            [ "Client ID", "{client_id}" ], [ "Client secret", "{client_secret}" ]
+          ]
+        },
+        {
+          key: "headscale", name: "Headscale",
+          redirects: [ "{base}/oidc/callback" ],
+          scopes: %w[openid profile email groups],
+          guide: "https://headscale.net/stable/ref/oidc/",
+          settings: [
+            [ "oidc.issuer", "{issuer}" ], [ "oidc.client_id", "{client_id}" ], [ "oidc.client_secret", "{client_secret}" ],
+            [ "oidc.scope", "[openid, profile, email, groups]" ], [ "oidc.allowed_groups", "[admins]" ]
+          ]
+        },
+        {
+          key: "home-assistant", name: "Home Assistant (OIDC integration)",
+          redirects: [ "{base}/auth/oidc/callback" ],
+          scopes: %w[openid profile email groups],
+          guide: "https://github.com/christiaangoossens/hass-oidc-auth",
+          settings: [
+            [ "auth_oidc.discovery_url", "{discovery}" ], [ "auth_oidc.client_id", "{client_id}" ],
+            [ "auth_oidc.client_secret", "{client_secret}" ], [ "auth_oidc.display_name", "{tenant}" ],
+            [ "auth_oidc.roles.admin", "admins" ]
+          ]
+        },
+        {
+          key: "synapse", name: "Matrix (Synapse)", asks: { "name" => "masks" },
+          redirects: [ "{base}/_synapse/client/oidc/callback" ],
+          scopes: %w[openid profile email],
+          guide: "https://element-hq.github.io/synapse/latest/openid.html",
+          settings: [
+            [ "oidc_providers", "- idp_id: {name}\n  idp_name: {tenant}\n  issuer: {issuer}\n  client_id: {client_id}\n" \
+                                "  client_secret: {client_secret}\n  scopes: [openid, profile, email]\n" \
+                                "  user_mapping_provider:\n    config:\n      localpart_template: \"{{ user.preferred_username }}\"\n" \
+                                "      display_name_template: \"{{ user.name }}\"\n      email_template: \"{{ user.email }}\"" ]
+          ]
+        },
+        {
+          key: "bookstack", name: "BookStack",
+          redirects: [ "{base}/oidc/callback" ],
+          scopes: %w[openid profile email groups],
+          guide: "https://www.bookstackapp.com/docs/admin/oidc-auth/",
+          settings: [
+            [ "AUTH_METHOD", "oidc" ], [ "OIDC_NAME", "{tenant}" ], [ "OIDC_ISSUER", "{issuer}" ], [ "OIDC_ISSUER_DISCOVER", "true" ],
+            [ "OIDC_CLIENT_ID", "{client_id}" ], [ "OIDC_CLIENT_SECRET", "{client_secret}" ],
+            [ "OIDC_DISPLAY_NAME_CLAIMS", "name" ], [ "OIDC_ADDITIONAL_SCOPES", "groups" ],
+            [ "OIDC_USER_TO_GROUPS", "true" ], [ "OIDC_GROUPS_CLAIM", "groups" ], [ "OIDC_REMOVE_FROM_GROUPS", "true" ]
+          ]
+        },
+        {
+          key: "wikijs", name: "Wiki.js", asks: { "name" => "masks" },
+          redirects: [ "{base}/login/{name}/callback" ],
+          scopes: %w[openid profile email groups],
+          guide: "https://docs.requarks.io/auth/oidc",
+          settings: [
+            [ "Client ID", "{client_id}" ], [ "Client Secret", "{client_secret}" ],
+            [ "Authorization Endpoint URL", "{authorize}" ], [ "Token Endpoint URL", "{token}" ],
+            [ "User Info Endpoint URL", "{userinfo}" ], [ "Issuer", "{issuer}" ], [ "Logout URL", "{logout}" ],
+            [ "Email Claim", "email" ], [ "Display Name Claim", "name" ], [ "Groups Claim", "groups" ],
+            [ "Callback URL", "{base}/login/{name}/callback" ]
+          ]
+        },
+        {
+          key: "minio", name: "MinIO",
+          redirects: [ "{base}/oauth_callback" ],
+          scopes: %w[openid profile email groups],
+          guide: "https://min.io/docs/minio/linux/operations/external-iam/configure-openid-external-identity-management.html",
+          settings: [
+            [ "MINIO_IDENTITY_OPENID_CONFIG_URL", "{discovery}" ], [ "MINIO_IDENTITY_OPENID_CLIENT_ID", "{client_id}" ],
+            [ "MINIO_IDENTITY_OPENID_CLIENT_SECRET", "{client_secret}" ], [ "MINIO_IDENTITY_OPENID_SCOPES", "openid,profile,email,groups" ],
+            [ "MINIO_IDENTITY_OPENID_CLAIM_NAME", "groups" ], [ "MINIO_IDENTITY_OPENID_REDIRECT_URI", "{base}/oauth_callback" ],
+            [ "MINIO_IDENTITY_OPENID_DISPLAY_NAME", "{tenant}" ]
+          ]
+        },
+        {
+          key: "argocd", name: "Argo CD",
+          redirects: [ "{base}/auth/callback", "{base}/api/dex/callback" ],
+          scopes: %w[openid profile email groups],
+          guide: "https://argo-cd.readthedocs.io/en/stable/operator-manual/user-management/#existing-oidc-provider",
+          settings: [
+            [ "argocd-cm oidc.config", "name: {tenant}\nissuer: {issuer}\nclientID: {client_id}\nclientSecret: {client_secret}\n" \
+                                       "requestedScopes: [openid, profile, email, groups]" ],
+            [ "argocd-rbac-cm policy.csv", "g, admins, role:admin" ], [ "argocd-rbac-cm scopes", "[groups]" ]
+          ]
+        },
+        {
+          key: "synology", name: "Synology DSM",
+          redirects: [ "{base}", "{base}/" ],
+          scopes: %w[openid profile email],
+          guide: "https://kb.synology.com/en-global/DSM/help/DSM/AdminCenter/connection_sso_client",
+          settings: [
+            [ "Profile", "OIDC" ], [ "Name", "{tenant}" ], [ "Well Known URL", "{discovery}" ],
+            [ "Client ID", "{client_id}" ], [ "Client secret", "{client_secret}" ],
+            [ "Scope", "openid profile email" ], [ "Username claim", "preferred_username" ], [ "Redirect URI", "{base}" ]
+          ]
         }
       ].map(&:freeze).freeze
 

data/app/models/masks/server/boot_task.rb

@@ -0,0 +1,41 @@
+require "socket"
+require "zlib"
+
+module Masks
+  module Server
+    class BootTask
+      WINDOW = 10.minutes
+
+      Outcome = Struct.new(:name, :host, :value, :done) do
+        def done? = done
+      end
+
+      class << self
+        def once(name, fingerprint: nil)
+          key = "masks:boot:#{name}:#{Digest::SHA256.hexdigest(fingerprint.to_s)[0, 16]}"
+          host = Socket.gethostname
+          outcome = nil
+
+          ActiveRecord::Base.transaction do
+            ActiveRecord::Base.connection.execute("SELECT pg_advisory_xact_lock(#{lock_id(name)})")
+            done_by = ::Rails.cache.read(key)
+
+            if done_by
+              outcome = Outcome.new(name, done_by, nil, false)
+            else
+              value = yield
+              ::Rails.cache.write(key, host, expires_in: WINDOW)
+              outcome = Outcome.new(name, host, value, true)
+            end
+          end
+
+          outcome
+        end
+
+        def lock_id(name)
+          Zlib.crc32("masks:boot:#{name}")
+        end
+      end
+    end
+  end
+end

data/app/models/masks/server/client.rb

@@ -82,6 +82,8 @@ module Masks
       validate :resources_are_named_only_when_approved
       validates :access_token_lifetime, numericality: { only_integer: true, in: 60..1.day.to_i }, allow_nil: true
       validates :refresh_token_lifetime, numericality: { only_integer: true, in: 5.minutes.to_i..400.days.to_i }, allow_nil: true
+      validates :refresh_token_absolute_lifetime, numericality: { only_integer: true, in: 5.minutes.to_i..400.days.to_i },
+                                                  allow_nil: true
       validates :consent_lifetime, numericality: { only_integer: true, greater_than_or_equal_to: 300,
                                                    less_than_or_equal_to: Consent::LONGEST.to_i }, allow_nil: true
 
@@ -377,6 +379,11 @@ module Masks
 
       def authenticate_secret(candidate)
         return true if public?
+
+        secret_matches?(candidate) && !secret_expired?
+      end
+
+      def secret_matches?(candidate)
         return false unless secret?
         return false if secret_digest.blank? || candidate.blank?
 
@@ -385,6 +392,10 @@ module Masks
         false
       end
 
+      def secret_expired?
+        secret_expires_at.present? && secret_expires_at.past?
+      end
+
       def redirect_uri?(candidate)
         redirect_uris.include?(candidate.to_s) || redirect_uris.any? { |registered| same_loopback?(registered, candidate.to_s) }
       end
@@ -445,6 +456,10 @@ module Masks
         refresh_token_lifetime&.seconds || RefreshToken.lifetime
       end
 
+      def refresh_absolute_lifetime
+        refresh_token_absolute_lifetime&.seconds || RefreshToken.absolute_lifetime
+      end
+
       def admits?(actor)
         allowed_groups.empty? || actor.group_labels.intersect?(allowed_groups)
       end

data/app/models/masks/server/client_keys.rb

@@ -78,7 +78,7 @@ module Masks
         raise Refused, "#{algorithm.presence || 'that'} is not an algorithm #{subject} may be signed with" unless ALGORITHMS.include?(algorithm)
 
         verified = attempt(token, header, algorithm, fresh: false)
-        verified ||= attempt(token, header, algorithm, fresh: true) if remote? && unknown_kid?(header)
+        verified ||= attempt(token, header, algorithm, fresh: true) if remote? && unknown_kid?(header) && refetch_open?
 
         verified || raise(Refused, "#{subject} was not signed by a key this client registered")
       rescue JWT::DecodeError
@@ -127,9 +127,20 @@ module Masks
           kid ? held.select { |jwk| jwk["kid"] == kid } : held
         end
 
+        def refetch_open?
+          return false if ::Rails.cache.exist?(refetched_key)
+
+          ::Rails.cache.write(refetched_key, Time.current.to_i, expires_in: LIFETIME)
+          true
+        end
+
         def cache_key
           "client-jwks:#{client.tenant_id}:#{client.id}:#{Digest::SHA256.hexdigest(client.jwks_uri.to_s)}"
         end
+
+        def refetched_key
+          "#{cache_key}:refetched"
+        end
     end
   end
 end

data/app/models/masks/server/declared.rb

@@ -5,7 +5,7 @@ module Masks
 
       TENANT_KEYS = %w[name accent_color groups apps].freeze
       APP_KEYS = %w[preset url slug name client_id client_secret_env redirect_uris scopes allowed_groups
-                    access_token_lifetime refresh_token_lifetime].freeze
+                    access_token_lifetime refresh_token_lifetime refresh_token_absolute_lifetime].freeze
 
       def self.apply!(path = ::Rails.configuration.masks.config_path)
         return [] if path.blank?
@@ -92,6 +92,7 @@ module Masks
             allowed_groups: Array(declared["allowed_groups"]),
             access_token_lifetime: declared["access_token_lifetime"],
             refresh_token_lifetime: declared["refresh_token_lifetime"],
+            refresh_token_absolute_lifetime: declared["refresh_token_absolute_lifetime"],
             consent_required: false
           }
 

data/app/models/masks/server/enrollment_token.rb

@@ -2,7 +2,7 @@ module Masks
   module Server
     class EnrollmentToken < Token
       SHORTEST = 1.minute
-      LONGEST = 1.hour
+      LONGEST = 1.day
 
       class << self
         def lifetime

data/app/models/masks/server/event.rb

@@ -18,6 +18,7 @@ module Masks
 
       ACCOUNT_CREATED = "account.created".freeze
       ACCOUNT_EXPORTED = "account.exported".freeze
+      NOTIFICATIONS_CHANGED = "notifications.changed".freeze
       INVITATION_SENT = "invitation.sent".freeze
       INVITATION_ACCEPTED = "invitation.accepted".freeze
 
@@ -145,6 +146,7 @@ module Masks
       SIGNAL_STREAM_UPDATED = "signal_stream.updated".freeze
       SIGNAL_STREAM_DELETED = "signal_stream.deleted".freeze
       SIGNAL_UNDELIVERED = "signal.undelivered".freeze
+      TEXT_UNDELIVERED = "text.undelivered".freeze
       SIGNAL_RECEIVED = "signal.received".freeze
 
       ORGANIZATION_CREATED = "organization.created".freeze
@@ -166,10 +168,13 @@ module Masks
       CUSTOM_DOMAIN_SERVED = "custom_domain.served".freeze
       CUSTOM_DOMAIN_STOPPED = "custom_domain.stopped".freeze
 
+      JOB_FAILED = "job.failed".freeze
+
       GRAVE = [
         LOGIN_REFUSED, LOGIN_THROTTLED, LOGOUT_UNDELIVERED, REFRESH_REUSED, STREAM_FAILED,
         DEVICE_BLOCKED, ACTOR_DELETED, AUTHENTICATOR_DISABLED, CONNECTION_REFUSED, DELEGATION_REFUSED,
-        EXCHANGE_REFUSED, SIGN_IN_RISKY, SIGNAL_UNDELIVERED, SIGNAL_RECEIVED, MEMBERSHIP_ROLE_KEPT, ORGANIZATION_OWNERLESS
+        EXCHANGE_REFUSED, SIGN_IN_RISKY, SIGNAL_UNDELIVERED, TEXT_UNDELIVERED, SIGNAL_RECEIVED, MEMBERSHIP_ROLE_KEPT,
+        ORGANIZATION_OWNERLESS, JOB_FAILED
       ].freeze
 
       ACTIONS = constants(false).filter_map do |name|

data/app/models/masks/server/job_failures.rb

@@ -0,0 +1,25 @@
+module Masks
+  module Server
+    module JobFailures
+      KEEP = 2.days
+      PREFIX = "masks:jobs:failed_tenants:".freeze
+
+      module_function
+
+      def record(job, subdomains)
+        ::Rails.cache.write("#{PREFIX}#{job}", subdomains.sort, expires_in: KEEP)
+      end
+
+      def last(job)
+        ::Rails.cache.read("#{PREFIX}#{job}") || []
+      end
+
+      def named(jobs)
+        jobs.map do |job|
+          tenants = last(job)
+          tenants.empty? ? job : "#{job} (#{tenants.join(', ')})"
+        end
+      end
+    end
+  end
+end

data/app/models/masks/server/notifications.rb

@@ -51,6 +51,10 @@ module Masks
 
       MAILED = GROUPS.values.flatten.freeze
 
+      ALWAYS = [ Event::PASSWORD_CHANGED, Event::PASSWORD_RESET_COMPLETED, Event::SIGN_IN_RISKY ].freeze
+
+      MUTABLE = (MAILED - ALWAYS).freeze
+
       ONCE_PER_DEVICE = [ Event::SESSION_STARTED ].freeze
 
       class << self
@@ -58,6 +62,10 @@ module Masks
           MAILED.include?(action.to_s)
         end
 
+        def always?(action)
+          ALWAYS.include?(action.to_s)
+        end
+
         def raised(event)
           return false unless mailed?(event.action) || WARNS_PREVIOUS.include?(event.action)
           return false unless event.actor_id && ActorMailer.deliverable?

data/app/models/masks/server/pending_request.rb

@@ -39,6 +39,14 @@ module Masks
         held("max_age")
       end
 
+      def refuse!(error, description)
+        update!(payload: (payload || {}).merge("refusal" => { "error" => error, "description" => description }))
+      end
+
+      def refusal
+        held("refusal")
+      end
+
       def issue_code!(actor:, device: nil, session: nil, authenticated_at: nil, amr: nil, organization: nil)
         AuthorizationCode.mint!(
           organization: organization,

data/app/models/masks/server/refresh_token.rb

@@ -5,6 +5,14 @@ module Masks
         30.days
       end
 
+      def self.absolute_lifetime
+        90.days
+      end
+
+      def exhausted?(limit)
+        root.created_at + limit <= Time.current
+      end
+
       def self.mint!(**attributes)
         super.tap { |token| token.actor&.active! }
       end

data/app/models/masks/server/released_nickname.rb

@@ -0,0 +1,26 @@
+module Masks
+  module Server
+    class ReleasedNickname < ApplicationRecord
+      include TenantScoped
+
+      HOLD = 30.days
+
+      belongs_to :actor, optional: true
+
+      scope :holding, ->(nickname) { where(nickname: nickname.to_s.downcase).where("released_at > ?", HOLD.ago) }
+      scope :lapsed, -> { where(released_at: ...HOLD.ago) }
+
+      class << self
+        def release!(nickname, actor:)
+          return if nickname.blank?
+
+          find_or_initialize_by(nickname: nickname.downcase).update!(actor: actor, released_at: Time.current)
+        end
+
+        def held_from?(nickname, actor)
+          holding(nickname).where.not(actor_id: actor.id).or(holding(nickname).where(actor_id: nil)).exists?
+        end
+      end
+    end
+  end
+end

data/app/models/masks/server/scim/filter.rb

@@ -1,8 +1,14 @@
+require "strscan"
+
 module Masks
   module Server
     module Scim
       class Filter
-        COMPARISON = /\A\s*([A-Za-z][\w.:\[\]" -]*?)\s+(eq|ne|co|sw|ew|pr|gt|ge|lt|le)(?:\s+("(?:[^"\\]|\\.)*"|true|false|null|[\d.]+))?\s*\z/i
+        LONGEST = 512
+        TOKEN = /"(?:[^"\\]|\\.)*"|(?:[^\s"\[]|\[[^\]]*\])+/
+        PATH = /\A[A-Za-z][\w.:\[\]" ]*\z/
+        VALUE = /\A(?:"(?:[^"\\]|\\.)*"|true|false|null|[\d.]+)\z/
+        OPERATORS = %w[eq ne co sw ew pr gt ge lt le].freeze
         ATTRIBUTES = {
           "id" => "actors.uuid",
           "username" => :user_name,
@@ -30,7 +36,9 @@ module Masks
         end
 
         def apply(relation)
-          clauses = @expression.split(/\s+and\s+/i)
+          raise Error.new(:bad_request, "a filter is at most #{LONGEST} characters", scim_type: "invalidFilter") if @expression.length > LONGEST
+
+          clauses = clauses_of(tokens)
 
           raise Error.new(:bad_request, "at most four comparisons joined by and are understood", scim_type: "invalidFilter") if clauses.size > 4
 
@@ -39,12 +47,44 @@ module Masks
 
         private
 
+          def tokens
+            scanner = StringScanner.new(@expression)
+            held = []
+
+            until scanner.eos?
+              next if scanner.skip(/\s+/)
+
+              token = scanner.scan(TOKEN)
+
+              raise unreadable(@expression) if token.nil?
+
+              held << token
+            end
+
+            held
+          end
+
+          def clauses_of(tokens)
+            clauses = [ [] ]
+
+            tokens.each do |token|
+              token.casecmp?("and") ? clauses << [] : clauses.last << token
+            end
+
+            clauses
+          end
+
+          def unreadable(clause)
+            Error.new(:bad_request, "#{clause.strip} is not a filter this server reads", scim_type: "invalidFilter")
+          end
+
           def compare(relation, clause)
-            match = COMPARISON.match(clause)
+            path, operator, raw = clause
 
-            raise Error.new(:bad_request, "#{clause.strip} is not a filter this server reads", scim_type: "invalidFilter") if match.nil?
+            raise unreadable(clause.join(" ")) unless clause.size.between?(2, 3)
+            raise unreadable(clause.join(" ")) unless PATH.match?(path) && OPERATORS.include?(operator.downcase)
+            raise unreadable(clause.join(" ")) unless raw.nil? || VALUE.match?(raw)
 
-            path, operator, raw = match.captures
             key = normalized(path)
             column = @columns[key]
             operator = operator.downcase

data/app/models/masks/server/scim/user.rb

@@ -118,6 +118,7 @@ module Masks
             raise Error.new(:bad_request, "userName is required", scim_type: "invalidValue") if value.blank?
 
             held = value.to_s.strip
+            actor.trusted_rename = true
 
             if held.match?(URI::MailTo::EMAIL_REGEXP)
               actor.email = held

data/app/models/masks/server/session.rb

@@ -72,11 +72,10 @@ module Masks
       end
 
       def first_factored!(held, at: nil)
-        changes = {}
-        changes[:authenticated_at] = at if at.present? && (authenticated_at.nil? || at > authenticated_at)
-        changes.merge!(first_factor: held["factor"], provider_id: held["provider_id"]) if held["factor"].present? && held != first_factored_by
+        self.authenticated_at = at if at && at > authenticated_at
+        assign_attributes(first_factor: held["factor"], provider_id: held["provider_id"]) if held["factor"].present?
 
-        update!(changes) if changes.any?
+        save! if changed?
       end
 
       def bound?