masks 0.10.0 → 0.12.0

data/lib/masks/client/device.rb

@@ -0,0 +1,47 @@
+module Masks
+  module Client
+    class Device
+      GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code".freeze
+      INTERVAL = 5
+      REQUIRED = %w[device_code user_code verification_uri].freeze
+
+      attr_reader :device_code, :user_code, :verification_uri, :verification_uri_complete, :expires_in, :interval,
+                  :obtained_at
+
+      def self.issued(body)
+        missing = REQUIRED.find { |field| body[field].to_s.empty? }
+
+        if missing
+          raise Rejected.new(
+            body["error"] || "invalid_device_authorization_response",
+            body["error_description"] || "the device authorization endpoint answered without a #{missing}"
+          )
+        end
+
+        new(body)
+      end
+
+      def initialize(body)
+        @device_code = body["device_code"]
+        @user_code = body["user_code"]
+        @verification_uri = body["verification_uri"]
+        @verification_uri_complete = body["verification_uri_complete"]
+        @expires_in = body["expires_in"].to_i
+        @interval = body["interval"].to_i
+        @obtained_at = Time.now.to_i
+      end
+
+      def expires_at
+        obtained_at + expires_in
+      end
+
+      def expired?
+        Time.now.to_i > expires_at
+      end
+
+      def inspect
+        "#<#{self.class.name} #{user_code} for #{verification_uri}>"
+      end
+    end
+  end
+end

data/lib/masks/client/embedded.rb

@@ -0,0 +1,125 @@
+require "stringio"
+
+module Masks
+  module Client
+    class Embedded
+      LOOPBACK = "127.0.0.1".freeze
+      DROPPED = %w[host accept-encoding connection content-length].freeze
+
+      attr_reader :app
+
+      def initialize(app, &serves)
+        raise ArgumentError, "an embedded issuer needs the app that serves it" if app.nil?
+        raise ArgumentError, "an embedded issuer needs a block naming the URLs it serves" if serves.nil?
+
+        @app = app
+        @serves = serves
+      end
+
+      def serves?(uri)
+        @serves.call(uri) ? true : false
+      end
+
+      def deliver(request, limit: nil)
+        uri = request.uri
+        status, headers, body = answer(environment(request, uri), uri, limit)
+
+        parsed(request, raw(status, headers, body))
+      end
+
+      def inspect
+        "#<#{self.class.name} #{app.inspect}>"
+      end
+
+      private
+
+        def answer(env, uri, limit)
+          worker = Thread.new { collected(*app.call(env), uri, limit) }
+          worker.report_on_exception = false
+
+          unless worker.join(HTTP::READ_TIMEOUT)
+            worker.kill
+            raise Unreachable, "#{uri.host} did not answer within #{HTTP::READ_TIMEOUT} seconds"
+          end
+
+          worker.value
+        rescue Error
+          raise
+        rescue StandardError => e
+          raise Unreachable, "#{uri.host} failed inside this process (#{e.class})"
+        end
+
+        def collected(status, headers, body, uri, limit)
+          held = "".b
+
+          body.each do |chunk|
+            held << chunk.to_s.b
+            raise Error, "#{uri.host} answered with more than #{limit} bytes" if limit && held.bytesize > limit
+          end
+
+          [ status.to_i, headers, held ]
+        ensure
+          body.close if body.respond_to?(:close)
+        end
+
+        def environment(request, uri)
+          input = request.body.to_s.b
+
+          env = {
+            "REQUEST_METHOD" => request.method,
+            "SCRIPT_NAME" => "",
+            "PATH_INFO" => uri.path.to_s.empty? ? "/" : uri.path,
+            "QUERY_STRING" => uri.query.to_s,
+            "SERVER_NAME" => uri.host,
+            "SERVER_PORT" => uri.port.to_s,
+            "SERVER_PROTOCOL" => "HTTP/1.1",
+            "REMOTE_ADDR" => LOOPBACK,
+            "HTTP_HOST" => Nonces.origin(uri).delete_prefix("#{uri.scheme}://"),
+            "HTTPS" => uri.scheme == "https" ? "on" : "off",
+            "rack.url_scheme" => uri.scheme,
+            "rack.input" => StringIO.new(input),
+            "rack.errors" => $stderr
+          }
+
+          env["CONTENT_LENGTH"] = input.bytesize.to_s unless input.empty?
+
+          request.each_header do |name, value|
+            next if DROPPED.include?(name)
+
+            key = name.upcase.tr("-", "_")
+            env[key == "CONTENT_TYPE" ? key : "HTTP_#{key}"] = value
+          end
+
+          env
+        end
+
+        def raw(status, headers, body)
+          lines = [ "HTTP/1.1 #{status} #{reason(status)}" ]
+
+          headers.each do |name, value|
+            next if %w[content-length transfer-encoding].include?(name.to_s.downcase)
+
+            Array(value).flat_map { |held| held.to_s.split(/\r?\n/) }.each { |held| lines << "#{name}: #{held}" }
+          end
+
+          lines << "content-length: #{body.bytesize}"
+
+          "#{lines.join("\r\n")}\r\n\r\n".b + body
+        end
+
+        def parsed(request, raw)
+          io = Net::BufferedIO.new(StringIO.new(raw))
+          response = Net::HTTPResponse.read_new(io)
+          response.uri = request.uri
+          response.reading_body(io, request.response_body_permitted?) { response.body }
+          response
+        end
+
+        def reason(status)
+          named = Net::HTTPResponse::CODE_TO_OBJ[status.to_s]
+
+          named ? named.name.delete_prefix("Net::HTTP").gsub(/(?<=[a-z])(?=[A-Z])/, " ") : "Unknown"
+        end
+    end
+  end
+end

data/lib/masks/client/enrollment.rb

@@ -0,0 +1,33 @@
+module Masks
+  module Client
+    class Enrollment
+      attr_reader :initial_access_token, :scope, :expires_in, :obtained_at
+
+      def self.issued(body)
+        if body["initial_access_token"].to_s.empty?
+          raise Rejected.new(
+            body["error"] || "invalid_enrollment_response",
+            body["error_description"] || "the enrollment endpoint answered without an initial_access_token"
+          )
+        end
+
+        new(body)
+      end
+
+      def initialize(body)
+        @initial_access_token = body["initial_access_token"]
+        @scope = body["scope"].to_s
+        @expires_in = body["expires_in"].to_i
+        @obtained_at = Time.now.to_i
+      end
+
+      def expires_at
+        obtained_at + expires_in
+      end
+
+      def scopes
+        scope.split
+      end
+    end
+  end
+end

data/lib/masks/client/errors.rb

@@ -4,6 +4,12 @@ module Masks
 
     class Unreachable < Error; end
 
+    class Foreign < Error; end
+
+    class Insecure < Error; end
+
+    class ReplayUnavailable < Error; end
+
     class Rejected < Error
       attr_reader :code, :description, :status
 

data/lib/masks/client/handshake.rb

@@ -6,17 +6,22 @@ module Masks
       AUTH_METHOD = "client_secret_basic".freeze
 
       attr_reader :issuer, :name, :resource, :redirect_uris, :scope, :return_to,
-                  :backchannel_logout_uri
+                  :post_logout_redirect_uri
 
       def initialize(issuer, name:, resource:, redirect_uris:, return_to:,
-                     scope: Session::DEFAULT_SCOPE, backchannel_logout_uri: nil)
+                     scope: Session::DEFAULT_SCOPE, backchannel_logout_uri: nil, post_logout_redirect_uri: nil)
         @issuer = Issuer.resolve(issuer)
         @name = name.to_s
         @resource = resource.to_s
         @redirect_uris = Array(redirect_uris).map(&:to_s)
         @scope = Array(scope).flat_map { |value| value.to_s.split(/\s+/) }.reject(&:empty?)
         @return_to = return_to.to_s
-        @backchannel_logout_uri = backchannel_logout_uri&.to_s
+        @backchannel_logout_uri = backchannel_logout_uri.to_s if present?(backchannel_logout_uri)
+        @post_logout_redirect_uri = post_logout_redirect_uri.to_s if present?(post_logout_redirect_uri)
+      end
+
+      def backchannel_logout_uri
+        @backchannel_logout_uri if @backchannel_logout_uri && issuer.backchannel_logout?
       end
 
       def endpoint
@@ -36,7 +41,10 @@ module Masks
           [ "state", state ]
         ]
 
-        query << [ "backchannel_logout_uri", backchannel_logout_uri ] if backchannel_logout_uri
+        backchannel = backchannel_logout_uri
+
+        query << [ "backchannel_logout_uri", backchannel ] if backchannel
+        query << [ "post_logout_redirect_uri", post_logout_redirect_uri ] if post_logout_redirect_uri
         redirect_uris.each { |uri| query << [ "redirect_uris", uri ] }
 
         "#{endpoint}?#{URI.encode_www_form(query)}"

data/lib/masks/client/http.rb

@@ -3,6 +3,8 @@ module Masks
     module HTTP
       OPEN_TIMEOUT = 5
       READ_TIMEOUT = 10
+      READ_LIMIT = 1 << 20
+      FETCH_LIMIT = 8 << 20
 
       module_function
 
@@ -11,12 +13,22 @@ module Masks
       end
 
       def post_form(url, form, headers = {})
-        uri = URI.parse(url.to_s)
-        request = Net::HTTP::Post.new(uri, default_headers.merge(headers))
+        encoded(Net::HTTP::Post, url, form, headers)
+      end
+
+      def delete_form(url, form, headers = {})
+        encoded(Net::HTTP::Delete, url, form, headers)
+      end
+
+      def encoded(verb, url, form, headers)
+        request(form_request(verb, url, form, headers))
+      end
+
+      def form_request(verb, url, form, headers)
+        request = verb.new(URI.parse(url.to_s), default_headers.merge(headers))
         request.body = URI.encode_www_form(form)
         request["Content-Type"] = "application/x-www-form-urlencoded"
-
-        self.request(request)
+        request
       end
 
       def post_json(url, body, headers = {})
@@ -32,16 +44,7 @@ module Masks
       end
 
       def fetch(url, headers = {})
-        uri = URI.parse(url.to_s)
-
-        Net::HTTP.start(
-          uri.hostname, uri.port,
-          use_ssl: uri.scheme == "https",
-          open_timeout: OPEN_TIMEOUT,
-          read_timeout: READ_TIMEOUT
-        ) { |http| http.request(Net::HTTP::Get.new(uri, headers)) }
-      rescue SystemCallError, SocketError, Net::OpenTimeout, Net::ReadTimeout, OpenSSL::SSL::SSLError => e
-        raise Unreachable, "#{uri.host} is unreachable (#{e.class})"
+        deliver(Net::HTTP::Get.new(checked(URI.parse(url.to_s)), headers), limit: FETCH_LIMIT)
       end
 
       def json(verb, url, body, headers)
@@ -58,26 +61,62 @@ module Masks
       end
 
       def request(request)
-        uri = request.uri
+        parse(deliver(request))
+      end
+
+      def deliver(request, limit: READ_LIMIT)
+        uri = checked(request.uri)
+        embedded = Masks::Client.embedded_for(uri)
+
+        return embedded.deliver(request, limit: limit) if embedded
 
-        response = Net::HTTP.start(
+        Net::HTTP.start(
           uri.hostname, uri.port,
           use_ssl: uri.scheme == "https",
           open_timeout: OPEN_TIMEOUT,
           read_timeout: READ_TIMEOUT
-        ) { |http| http.request(request) }
-
-        parse(response)
+        ) { |http| limit ? limited(http, request, limit) : http.request(request) }
       rescue SystemCallError, SocketError, Net::OpenTimeout, Net::ReadTimeout, OpenSSL::SSL::SSLError => e
         raise Unreachable, "#{uri.host} is unreachable (#{e.class})"
       end
 
-      def parse(response)
-        body = begin
-          JSON.parse(response.body.to_s)
-        rescue JSON::ParserError
-          {}
+      def checked(uri)
+        return uri if uri.is_a?(URI::HTTPS) && !uri.host.to_s.empty?
+        return uri if uri.is_a?(URI::HTTP) && !uri.host.to_s.empty? && (Masks::Client.plain_http? || loopback?(uri.hostname))
+
+        if uri.is_a?(URI::HTTP)
+          raise Insecure, "#{Nonces.origin(uri)} is plain http, which masks allows only for loopback hosts " \
+                          "unless Masks::Client.plain_http is set"
+        end
+
+        raise Error, "#{uri} is not an http or https URL"
+      end
+
+      def loopback?(host)
+        name = host.to_s.downcase
+
+        return true if name == "localhost" || name.end_with?(".localhost")
+
+        IPAddr.new(name).loopback?
+      rescue IPAddr::Error
+        false
+      end
+
+      def limited(http, request, limit)
+        http.request(request) do |response|
+          body = +""
+
+          response.read_body do |chunk|
+            body << chunk
+            raise Error, "#{request.uri.host} answered with more than #{limit} bytes" if body.bytesize > limit
+          end
+
+          response.body = body
         end
+      end
+
+      def parse(response)
+        body = decoded(response)
 
         unless response.is_a?(Net::HTTPSuccess)
           refusal = Unregistered.raised_by?(body) ? Unregistered : Rejected
@@ -91,6 +130,30 @@ module Masks
 
         body
       end
+
+      def decoded(response)
+        raw = response.body.to_s
+        return {} if raw.strip.empty?
+
+        held = JSON.parse(raw)
+
+        return held if held.is_a?(Hash)
+        return {} unless response.is_a?(Net::HTTPSuccess)
+
+        raise Rejected.new("invalid_response", "#{origin(response)} answered with JSON that is not an object",
+                           status: response.code.to_i)
+      rescue JSON::ParserError
+        return {} unless response.is_a?(Net::HTTPSuccess)
+
+        raise Rejected.new("invalid_response", "#{origin(response)} answered with something other than JSON",
+                           status: response.code.to_i)
+      end
+
+      def origin(response)
+        uri = response.uri
+
+        uri ? Nonces.origin(uri) : "the server"
+      end
     end
   end
 end

data/lib/masks/client/issuer.rb

@@ -14,13 +14,14 @@ module Masks
         Masks::Client.registry[issuer, ttl: ttl]
       end
 
-      attr_reader :url
+      attr_reader :url, :nonces
 
       def initialize(url, ttl: TTL)
         @url = self.class.normalize(url)
         @ttl = ttl
         @cache = {}
         @lock = Mutex.new
+        @nonces = Nonces.new
       end
 
       def discovery

data/lib/masks/client/key.rb

@@ -0,0 +1,100 @@
+module Masks
+  module Client
+    class Key
+      CURVE = "prime256v1".freeze
+      ALGORITHM = "ES256".freeze
+      PUBLIC = %w[kty crv x y].freeze
+
+      def self.generate
+        new(OpenSSL::PKey::EC.generate(CURVE))
+      end
+
+      def self.parse(data)
+        held = data.is_a?(String) && !data.lstrip.start_with?("{") ? OpenSSL::PKey.read(data) : imported(data)
+
+        new(held)
+      rescue OpenSSL::PKey::PKeyError, JSON::ParserError, JWT::JWKError, ArgumentError
+        raise ArgumentError, "a key is a private P-256 key, as a PEM or a JWK"
+      end
+
+      def self.from(value)
+        case value
+        when self then value
+        when OpenSSL::PKey::PKey then new(value)
+        else parse(value)
+        end
+      end
+
+      def self.imported(data)
+        held = data.is_a?(String) ? JSON.parse(data) : data.to_h
+
+        JWT::JWK.import(held.transform_keys(&:to_sym)).signing_key
+      end
+
+      def self.htu(url)
+        uri = URI.parse(url.to_s)
+        uri.query = nil
+        uri.fragment = nil
+
+        uri.to_s
+      end
+
+      attr_reader :private_key, :thumbprint
+
+      def initialize(private_key)
+        unless private_key.is_a?(OpenSSL::PKey::EC) && private_key.private? && private_key.group.curve_name == CURVE
+          raise ArgumentError, "a key is a private P-256 key"
+        end
+
+        @private_key = private_key
+        @public = JWT::JWK.new(private_key).export.transform_keys(&:to_s).slice(*PUBLIC).freeze
+        @thumbprint = Proof.thumbprint(@public)
+      end
+
+      alias_method :kid, :thumbprint
+
+      def public_jwk
+        @public.merge("kid" => thumbprint, "alg" => ALGORITHM, "use" => "sig")
+      end
+
+      def jwks
+        { "keys" => [ public_jwk ] }
+      end
+
+      def to_h
+        JWT::JWK.new(private_key).export(include_private: true).transform_keys(&:to_s)
+                .merge("kid" => thumbprint, "alg" => ALGORITHM, "use" => "sig")
+      end
+
+      def to_json(*)
+        JSON.generate(to_h)
+      end
+
+      def to_pem
+        private_key.private_to_pem
+      end
+
+      def inspect
+        "#<#{self.class.name} #{thumbprint}>"
+      end
+
+      def sign(claims, header = {})
+        JWT.encode(claims, private_key, ALGORITHM, header)
+      end
+
+      def proof(method, url, access_token: nil, nonce: nil)
+        claims = {
+          "jti" => SecureRandom.urlsafe_base64(24),
+          "htm" => method.to_s.upcase,
+          "htu" => self.class.htu(url),
+          "iat" => Time.now.to_i
+        }
+
+        claims["ath"] = Proof.digest(access_token) unless access_token.to_s.empty?
+        claims["nonce"] = nonce unless nonce.to_s.empty?
+
+        sign(claims, { typ: Proof::TYPE, jwk: @public })
+      end
+    end
+  end
+end

data/lib/masks/client/logout.rb

@@ -9,7 +9,7 @@ module Masks
         def verify(token, issuer:, audience:, algorithms: ALGORITHMS)
           held = Verifier
             .new(issuer, audience: audience, algorithms: algorithms)
-            .verify(token, required: %w[iss aud iat jti events], typ: Verifier::LOGOUT_TOKEN)
+            .verify(token, required: %w[iss aud iat exp jti events], typ: Verifier::LOGOUT_TOKEN)
 
           new(held).validate!
         end
@@ -37,6 +37,10 @@ module Masks
         Time.at(claims["iat"].to_i).utc
       end
 
+      def expires_at
+        Time.at(claims["exp"].to_i).utc
+      end
+
       def validate!
         refuse!("logout token carries a nonce, so it is an id token") if claims.key?("nonce")
         refuse!("logout token names neither a subject nor a session") if subject.nil? && sid.nil?

data/lib/masks/client/nonces.rb

@@ -0,0 +1,31 @@
+module Masks
+  module Client
+    class Nonces
+      HEADER = "DPoP-Nonce".freeze
+
+      def self.origin(url)
+        uri = url.is_a?(URI::Generic) ? url : URI.parse(url.to_s)
+        port = ":#{uri.port}" unless uri.port.nil? || uri.port == uri.default_port
+
+        "#{uri.scheme.to_s.downcase}://#{uri.host.to_s.downcase}#{port}"
+      end
+
+      def initialize
+        @held = {}
+        @lock = Mutex.new
+      end
+
+      def [](url)
+        @lock.synchronize { @held[self.class.origin(url)] }
+      end
+
+      def learn(url, response)
+        wanted = response[HEADER].to_s.strip
+
+        return nil if wanted.empty?
+
+        @lock.synchronize { @held[self.class.origin(url)] = wanted }
+      end
+    end
+  end
+end

data/lib/masks/client/proof.rb

@@ -139,11 +139,17 @@ module Masks
           jti = claims["jti"].to_s
 
           raise Invalid, "a proof must carry a jti" if jti.empty?
-          return if @replay.nil? || @replay.first?("#{thumbprint}:#{jti}", expires_in: MEMORY)
+          return if @replay.nil? || first?("#{thumbprint}:#{jti}")
 
           raise Invalid, "that proof has already been used"
         end
 
+        def first?(key)
+          @replay.first?(key, expires_in: MEMORY)
+        rescue StandardError => e
+          raise ReplayUnavailable, "the replay store could not say whether that proof is new (#{e.class})"
+        end
+
         def same?(held, expected)
           !held.to_s.empty? && held.bytesize == expected.to_s.bytesize &&
             OpenSSL.fixed_length_secure_compare(held, expected.to_s)

data/lib/masks/client/rack.rb

@@ -25,6 +25,8 @@ module Masks
         return passthrough(env, e) if @optional && e.is_a?(Unauthenticated)
 
         refuse(resource(env), e)
+      rescue ReplayUnavailable
+        unavailable
       end
 
       private
@@ -56,6 +58,12 @@ module Masks
           @resource.respond_to?(:call) ? @resource.call(env) : @resource
         end
 
+        def unavailable
+          body = JSON.generate({ "error" => "temporarily_unavailable", "error_description" => "the token could not be checked" })
+
+          [ 503, { "content-type" => "application/json", "cache-control" => "no-store" }, [ body ] ]
+        end
+
         def refuse(resource, error)
           body = JSON.generate(
             { "error" => error.code, "error_description" => error.description }.compact