masks 0.10.0 → 0.11.0

data/lib/masks/rails/authentication.rb

@@ -7,12 +7,13 @@ module Masks
 
       included do
         if respond_to?(:helper_method)
-          helper_method :masked, :masks_login_url, :masks_logout_url
+          helper_method :masked, :masks_login_url
         end
       end
 
       REQUESTS = "masks_requests".freeze
       HANDSHAKES = "masks_handshakes".freeze
+      FAREWELLS = "masks_farewells".freeze
       STEPPED_UP = "masks_stepped_up".freeze
       STEP_UP_WITHIN = 300
 
@@ -28,6 +29,10 @@ module Masks
         @masks_handshakes ||= masks_tracker(HANDSHAKES)
       end
 
+      def masks_farewells
+        masks_tracker(FAREWELLS)
+      end
+
       def masks_tracker(key)
         Masks::Client::Tracker.new(Masks::Client::Stores::Session.new(session, key))
       end
@@ -152,21 +157,17 @@ module Masks
         profile.empty? ? nil : held.merge(profile.slice(*IDENTITY))
       end
 
-      def masks_logout_url(return_to: nil)
+      def masks_logout_url(state:)
         return nil unless masks_configured?
 
         masks_session.end_session_url(
-          post_logout_redirect_uri: masks_post_logout_redirect_uri,
-          state: SecureRandom.urlsafe_base64(16)
+          post_logout_redirect_uri: masks_config.return_to_for(request),
+          state: state
         )
       rescue Masks::Client::Error
         nil
       end
 
-      def masks_post_logout_redirect_uri
-        "#{request.base_url}#{masks_local_path(masks_config.after_sign_out) || '/'}"
-      end
-
       def masks_login_url(return_to: nil, organization: nil, privilege: nil)
         path = Masks::Rails::Engine.routes.url_helpers.start_path
         query = {
@@ -193,6 +194,20 @@ module Masks
 
       private
 
+        def masks_sign_out_upstream
+          return nil unless masks_configured?
+
+          farewell = masks_farewells.open
+          url = masks_logout_url(state: farewell.id)
+
+          masks_farewells.clear! if url.nil?
+          url
+        end
+
+        def masks_after_sign_out_path
+          masks_local_path(masks_config.after_sign_out) || "/"
+        end
+
         def masks_authorize_session!(wanted)
           return false unless authenticate_masks!
 

data/lib/masks/rails/configuration.rb

@@ -11,7 +11,7 @@ module Masks
                     :after_sign_out, :session_key, :sign_out_of_issuer, :parent_controller,
                     :credentials_path, :authenticate_everything, :delegates
       attr_writer :issuer, :redirect_uri, :name, :credentials, :store, :forget, :logged_out,
-                  :delegation_redirect_uri, :organization, :manages
+                  :delegation_redirect_uri, :organization, :manages, :replay
 
       def initialize
         @scope = Masks::Client::Session::DEFAULT_SCOPE
@@ -139,10 +139,15 @@ module Masks
         Masks::Client::Resource.new(
           issuer: issuer_for(request),
           url: url,
-          scopes: resource_scopes
+          scopes: resource_scopes,
+          replay: replay
         )
       end
 
+      def replay
+        @replay || Masks::Client::Proof.memory
+      end
+
       def handshake_for(request)
         Masks::Client::Handshake.new(
           issuer_for(request),

data/lib/masks/rails/protected_resource.rb

@@ -5,6 +5,10 @@ module Masks
       include Masks::Rails::Configurable
       include Masks::Rails::Privileged
 
+      included do
+        rescue_from Masks::Client::ReplayUnavailable, with: :masks_unavailable if respond_to?(:rescue_from)
+      end
+
       def masks_resource
         @masks_resource ||= masks_config.resource_server_for(request)
       end
@@ -41,6 +45,15 @@ module Masks
         }, status: error.status
       end
 
+      def masks_unavailable
+        response.headers["Cache-Control"] = "no-store"
+
+        render json: {
+          "error" => "temporarily_unavailable",
+          "error_description" => "the token could not be checked"
+        }, status: :service_unavailable
+      end
+
       def masks_resource_metadata
         masks_resource.metadata
       end

data/lib/masks/version.rb

@@ -1,3 +1,3 @@
 module Masks
-  VERSION = "0.10.0".freeze
+  VERSION = "0.11.0".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: masks
 version: !ruby/object:Gem::Version
-  version: 0.10.0
+  version: 0.11.0
 platform: ruby
 authors:
 - the masks authors
@@ -50,12 +50,17 @@ files:
 - lib/masks/client/claims.rb
 - lib/masks/client/delegations.rb
 - lib/masks/client/delegations/fake.rb
+- lib/masks/client/device.rb
+- lib/masks/client/embedded.rb
+- lib/masks/client/enrollment.rb
 - lib/masks/client/errors.rb
 - lib/masks/client/handshake.rb
 - lib/masks/client/http.rb
 - lib/masks/client/introspection.rb
 - lib/masks/client/issuer.rb
+- lib/masks/client/key.rb
 - lib/masks/client/logout.rb
+- lib/masks/client/nonces.rb
 - lib/masks/client/pkce.rb
 - lib/masks/client/proof.rb
 - lib/masks/client/rack.rb
@@ -66,6 +71,7 @@ files:
 - lib/masks/client/stores.rb
 - lib/masks/client/tokens.rb
 - lib/masks/client/tracker.rb
+- lib/masks/client/transport.rb
 - lib/masks/client/verifier.rb
 - lib/masks/rails.rb
 - lib/masks/rails/authentication.rb