masks 0.10.0 → 0.12.0

data/lib/masks/rails/authentication.rb

@@ -7,12 +7,17 @@ module Masks
 
       included do
         if respond_to?(:helper_method)
-          helper_method :masked, :masks_login_url, :masks_logout_url
+          helper_method :masked, :masks_login_url
+        end
+
+        if respond_to?(:rescue_from) && method_defined?(:render)
+          rescue_from Masks::Rails::Cache::Unavailable, with: :masks_cache_unavailable
         end
       end
 
       REQUESTS = "masks_requests".freeze
       HANDSHAKES = "masks_handshakes".freeze
+      FAREWELLS = "masks_farewells".freeze
       STEPPED_UP = "masks_stepped_up".freeze
       STEP_UP_WITHIN = 300
 
@@ -28,6 +33,10 @@ module Masks
         @masks_handshakes ||= masks_tracker(HANDSHAKES)
       end
 
+      def masks_farewells
+        masks_tracker(FAREWELLS)
+      end
+
       def masks_tracker(key)
         Masks::Client::Tracker.new(Masks::Client::Stores::Session.new(session, key))
       end
@@ -35,24 +44,42 @@ module Masks
       def masks_tokens
         return @masks_tokens if defined?(@masks_tokens)
 
-        @masks_tokens = Masks::Client::Tokens.from_h(session[masks_config.session_key])
+        held = masks_held
+
+        if held.present? && masks_departed?(held)
+          masks_forget
+          return nil
+        end
+
+        @masks_tokens = Masks::Client::Tokens.from_h(held)
+      end
+
+      def masks_cache
+        @masks_cache ||= Masks::Rails::Cache.new(masks_config.cache)
       end
 
       def masks_store(tokens, identity: nil)
         held = tokens.to_h.except("id_token")
+        held.delete("token_type") if held["token_type"] == "Bearer"
         held["identity"] = identity&.slice(*IDENTITY) || masks_held["identity"]
+        held["signed_in_at"] = masks_held["signed_in_at"] || Masks::Rails::Cache.now
 
-        session[masks_config.session_key] = held.compact
+        masks_session_cookies.write(held.compact)
+        @masks_held = held.compact
         @masks_tokens = tokens
         @masked = nil
       end
 
       def masks_held
-        session[masks_config.session_key] || {}
+        @masks_held ||= masks_session_cookies.read || {}
+      end
+
+      def masks_session_cookies
+        Masks::Rails::SessionCookies.new(request, masks_config.session_key)
       end
 
       IDENTITY = [
-        "sub", "name", "preferred_username", "email", "email_verified", "tenant",
+        "sub", "sid", "name", "preferred_username", "email", "email_verified", "tenant",
         "picture", Masks::Client::Claims::AVATARS, Masks::Client::Claims::ORGANIZATION,
         Masks::Client::Claims::ORGANIZATIONS
       ].freeze
@@ -64,7 +91,8 @@ module Masks
       end
 
       def masks_forget
-        session.delete(masks_config.session_key)
+        masks_session_cookies.clear
+        @masks_held = {}
         @masks_tokens = nil
         @masked = nil
       end
@@ -124,22 +152,34 @@ module Masks
       end
 
       def masks_refresh!
-        return false unless masks_configured?
-        return false if masks_tokens&.refresh_token.nil?
+        return false unless masks_configured? && masks_tokens
 
-        refreshed = masks_session.refresh(
-          masks_tokens.refresh_token,
-          resource: masks_config.resource_for(request)
-        )
+        spent = masks_tokens.refresh_token
 
-        masks_store(refreshed, identity: masks_refreshed_identity(refreshed))
-        true
-      rescue Masks::Client::Unregistered
-        masks_disconnect!
-        false
-      rescue Masks::Client::Rejected
-        masks_forget
-        false
+        if spent.nil?
+          masks_forget
+          return false
+        end
+
+        renewal = begin
+          masks_cache.renew(masks_config.issuer_for(request).to_s, spent) { masks_renewal(spent) }
+        rescue Masks::Rails::Cache::Unavailable
+          Masks::Rails::Renewal.unreachable
+        end
+
+        case renewal.outcome
+        when :renewed
+          masks_store(renewal.tokens, identity: renewal.identity)
+          true
+        when :unregistered
+          masks_disconnect!
+          false
+        when :refused
+          masks_forget
+          false
+        else
+          false
+        end
       end
 
       def masks_refreshed_identity(tokens)
@@ -149,22 +189,9 @@ module Masks
 
         profile = masks_session.profile(tokens)
 
-        profile.empty? ? nil : held.merge(profile.slice(*IDENTITY))
-      end
-
-      def masks_logout_url(return_to: nil)
-        return nil unless masks_configured?
+        return nil if profile.empty? || profile["sub"].to_s != held["sub"].to_s
 
-        masks_session.end_session_url(
-          post_logout_redirect_uri: masks_post_logout_redirect_uri,
-          state: SecureRandom.urlsafe_base64(16)
-        )
-      rescue Masks::Client::Error
-        nil
-      end
-
-      def masks_post_logout_redirect_uri
-        "#{request.base_url}#{masks_local_path(masks_config.after_sign_out) || '/'}"
+        held.merge(profile.slice(*IDENTITY))
       end
 
       def masks_login_url(return_to: nil, organization: nil, privilege: nil)
@@ -193,6 +220,47 @@ module Masks
 
       private
 
+        def masks_departed?(held)
+          identity = held["identity"]
+
+          return false unless identity.is_a?(Hash)
+
+          masks_cache.departed?(masks_config.issuer_for(request).to_s, identity, since: held["signed_in_at"].to_i)
+        rescue Masks::Rails::Configuration::Unconfigured
+          false
+        end
+
+        def masks_renewal(spent)
+          refreshed = masks_session.refresh(spent, resource: masks_config.resource_for(request))
+          refreshed = Masks::Client::Tokens.from_h(refreshed.to_h.merge("refresh_token" => spent)) if refreshed.refresh_token.nil?
+
+          Masks::Rails::Renewal.renewed(refreshed, masks_refreshed_identity(refreshed))
+        rescue Masks::Client::Unregistered
+          Masks::Rails::Renewal.unregistered
+        rescue Masks::Client::Rejected => e
+          e.status.to_i >= 500 || e.status.to_i == 429 ? Masks::Rails::Renewal.unreachable : Masks::Rails::Renewal.refused
+        rescue Masks::Client::Error
+          Masks::Rails::Renewal.unreachable
+        end
+
+        def masks_sign_out_upstream
+          return nil unless masks_configured?
+
+          farewell = masks_farewells.open
+
+          masks_session.end_session_url(
+            post_logout_redirect_uri: masks_config.post_logout_redirect_uri_for(request),
+            state: farewell.id
+          )
+        rescue Masks::Client::Error
+          masks_farewells.clear!
+          nil
+        end
+
+        def masks_after_sign_out_path
+          masks_local_path(masks_config.after_sign_out) || "/"
+        end
+
         def masks_authorize_session!(wanted)
           return false unless authenticate_masks!
 
@@ -253,6 +321,18 @@ module Masks
           redirect_to Masks::Rails::Engine.routes.url_helpers.start_path
         end
 
+        def masks_cache_unavailable(error)
+          response.headers["Cache-Control"] = "no-store"
+          response.headers["Retry-After"] = "5"
+
+          if masks_wants_json?
+            render json: { "error" => "temporarily_unavailable", "error_description" => error.message },
+                   status: :service_unavailable
+          else
+            render plain: "Signing in is unavailable right now. Try again in a moment.", status: :service_unavailable
+          end
+        end
+
         def masks_refuse_json
           response.headers["Cache-Control"] = "no-store"
 

data/lib/masks/rails/cache.rb

@@ -0,0 +1,173 @@
+module Masks
+  module Rails
+    class Cache
+      class Unavailable < Masks::Client::Error; end
+
+      CLAIM = 30
+      RESULT = 60
+      WAIT = 0.05
+      PATIENCE = 30
+      LOGOUT = 600
+      LOGOUT_LEEWAY = 120
+      DEPARTURE = 30 * 24 * 3600
+      CIPHER = "aes-256-gcm".freeze
+      NONCE = 12
+      TAG = 16
+
+      def self.key(*parts)
+        "masks:#{OpenSSL::Digest::SHA256.hexdigest(parts.map(&:to_s).join("\0"))}"
+      end
+
+      def self.now
+        (Time.now.to_f * 1000).to_i
+      end
+
+      attr_reader :store
+
+      def initialize(store)
+        @store = store
+      end
+
+      def first?(key, expires_in:)
+        add(self.class.key("proof", key), expires_in)
+      end
+
+      def first_logout?(issuer, logout)
+        add(self.class.key("logout", issuer, logout.jti), logout_memory(logout))
+      end
+
+      def depart!(issuer, logout)
+        kind, value = logout.sid.to_s.empty? ? [ "sub", logout.subject ] : [ "sid", logout.sid ]
+
+        kept = begin
+          write(self.class.key("departed", issuer, kind, value), self.class.now, expires_in: DEPARTURE)
+        rescue Unavailable
+          false
+        end
+
+        return if kept
+
+        forgotten { delete(self.class.key("logout", issuer, logout.jti)) }
+
+        raise Unavailable, "the cache did not keep that logout"
+      end
+
+      def departed?(issuer, identity, since:)
+        [ [ "sid", identity["sid"] ], [ "sub", identity["sub"] ] ].any? do |kind, value|
+          next false if value.to_s.empty?
+
+          at = read(self.class.key("departed", issuer, kind, value))
+
+          at.is_a?(Integer) && at >= since
+        end
+      end
+
+      def renew(issuer, refresh_token)
+        result = self.class.key("refreshed", issuer, refresh_token)
+        claim = self.class.key("refreshing", issuer, refresh_token)
+        found = opened(result, refresh_token)
+
+        return found if found
+        return awaited(result, claim, refresh_token) unless add(claim, CLAIM)
+
+        begin
+          held = yield
+
+          forgotten { write(result, sealed(refresh_token, held), expires_in: RESULT) } unless held.outcome == :unreachable
+
+          held
+        ensure
+          forgotten { delete(claim) }
+        end
+      end
+
+      private
+
+        def add(key, expires_in)
+          return true if write(key, 1, unless_exist: true, expires_in: expires_in)
+          return false unless read(key).nil?
+
+          raise Unavailable, "the cache neither kept that key nor holds it, so it is not answering"
+        end
+
+        def read(key)
+          reached { store.read(key) }
+        end
+
+        def write(key, value, **options)
+          reached { store.write(key, value, **options) }
+        end
+
+        def delete(key)
+          reached { store.delete(key) }
+        end
+
+        def reached
+          yield
+        rescue Unavailable
+          raise
+        rescue StandardError => e
+          raise Unavailable, "the cache could not be reached (#{e.class})"
+        end
+
+        def forgotten
+          yield
+        rescue Unavailable
+          nil
+        end
+
+        def logout_memory(logout)
+          [ LOGOUT, logout.expires_at.to_i - Time.now.to_i + LOGOUT_LEEWAY ].max
+        end
+
+        def awaited(result, claim, refresh_token)
+          deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + PATIENCE
+
+          while Process.clock_gettime(Process::CLOCK_MONOTONIC) < deadline
+            sleep WAIT
+
+            found = opened(result, refresh_token)
+
+            return found if found
+            return opened(result, refresh_token) || Renewal.unreachable if read(claim).nil?
+          end
+
+          Renewal.unreachable
+        end
+
+        def cipher(mode, refresh_token)
+          held = OpenSSL::Cipher.new(CIPHER).public_send(mode)
+          held.key = OpenSSL::KDF.hkdf(refresh_token.to_s, salt: "masks", info: "masks/rails shared refresh",
+                                                           length: 32, hash: "SHA256")
+          held
+        end
+
+        def sealed(refresh_token, held)
+          plain = JSON.generate(held.to_h)
+          sealing = cipher(:encrypt, refresh_token)
+          nonce = SecureRandom.random_bytes(NONCE)
+          sealing.iv = nonce
+          sealing.auth_data = ""
+          body = sealing.update(plain) + sealing.final
+
+          Base64.strict_encode64(nonce + sealing.auth_tag(TAG) + body)
+        end
+
+        def opened(result, refresh_token)
+          held = read(result)
+
+          return nil if held.nil?
+
+          raw = Base64.strict_decode64(held.to_s)
+          opening = cipher(:decrypt, refresh_token)
+          opening.iv = raw.byteslice(0, NONCE)
+          opening.auth_tag = raw.byteslice(NONCE, TAG)
+          opening.auth_data = ""
+
+          Renewal.from_h(JSON.parse(opening.update(raw.byteslice((NONCE + TAG)..).to_s) + opening.final))
+        rescue ArgumentError, TypeError, OpenSSL::Cipher::CipherError, JSON::ParserError
+          Renewal.unreachable
+        end
+    end
+  end
+end

data/lib/masks/rails/configuration.rb

@@ -11,7 +11,7 @@ module Masks
                     :after_sign_out, :session_key, :sign_out_of_issuer, :parent_controller,
                     :credentials_path, :authenticate_everything, :delegates
       attr_writer :issuer, :redirect_uri, :name, :credentials, :store, :forget, :logged_out,
-                  :delegation_redirect_uri, :organization, :manages
+                  :delegation_redirect_uri, :organization, :manages, :cache
 
       def initialize
         @scope = Masks::Client::Session::DEFAULT_SCOPE
@@ -80,18 +80,13 @@ module Masks
       end
 
       def backchannel_logout_uri_for(request)
-        return nil unless @logged_out.respond_to?(:call)
-        return nil unless Masks::Client::Issuer.resolve(issuer_for(request)).backchannel_logout?
-
         "#{request.base_url}#{routes.backchannel_logout_path}"
       end
 
       def logged_out!(request, logout)
-        return false unless @logged_out.respond_to?(:call)
+        return unless @logged_out.respond_to?(:call)
 
         @logged_out.arity == 1 ? @logged_out.call(logout) : @logged_out.call(request, logout)
-
-        true
       end
 
       def manages?(request, masked = nil)
@@ -139,10 +134,21 @@ module Masks
         Masks::Client::Resource.new(
           issuer: issuer_for(request),
           url: url,
-          scopes: resource_scopes
+          scopes: resource_scopes,
+          replay: Cache.new(cache)
         )
       end
 
+      def cache
+        return @cache if @cache
+
+        held = ::Rails.cache if ::Rails.respond_to?(:cache)
+
+        return held unless held.nil? || held.is_a?(ActiveSupport::Cache::NullStore)
+
+        @process_cache ||= ActiveSupport::Cache::MemoryStore.new
+      end
+
       def handshake_for(request)
         Masks::Client::Handshake.new(
           issuer_for(request),
@@ -152,7 +158,8 @@ module Masks
           redirect_uris: [ redirect_uri_for(request), delegation_redirect_uri_for(request) ].compact.uniq,
           return_to: return_to_for(request),
           scope: approved_scope,
-          backchannel_logout_uri: backchannel_logout_uri_for(request)
+          backchannel_logout_uri: backchannel_logout_uri_for(request),
+          post_logout_redirect_uri: post_logout_redirect_uri_for(request)
         )
       end
 
@@ -189,14 +196,22 @@ module Masks
       end
 
       def return_to_for(request)
-        uri = URI.parse(redirect_uri_for(request))
-        port = ":#{uri.port}" unless uri.port == uri.default_port
+        "#{origin_for(request)}#{routes.handshake_callback_path}"
+      end
 
-        "#{uri.scheme}://#{uri.host}#{port}#{routes.handshake_callback_path}"
+      def post_logout_redirect_uri_for(request)
+        "#{origin_for(request)}#{routes.logout_return_path}"
       end
 
       private
 
+        def origin_for(request)
+          uri = URI.parse(redirect_uri_for(request))
+          port = ":#{uri.port}" unless uri.port == uri.default_port
+
+          "#{uri.scheme}://#{uri.host}#{port}"
+        end
+
         def routes
           Masks::Rails::Engine.routes.url_helpers
         end

data/lib/masks/rails/protected_resource.rb

@@ -5,6 +5,10 @@ module Masks
       include Masks::Rails::Configurable
       include Masks::Rails::Privileged
 
+      included do
+        rescue_from Masks::Client::ReplayUnavailable, with: :masks_unavailable if respond_to?(:rescue_from)
+      end
+
       def masks_resource
         @masks_resource ||= masks_config.resource_server_for(request)
       end
@@ -41,6 +45,15 @@ module Masks
         }, status: error.status
       end
 
+      def masks_unavailable
+        response.headers["Cache-Control"] = "no-store"
+
+        render json: {
+          "error" => "temporarily_unavailable",
+          "error_description" => "the token could not be checked"
+        }, status: :service_unavailable
+      end
+
       def masks_resource_metadata
         masks_resource.metadata
       end

data/lib/masks/rails/renewal.rb

@@ -0,0 +1,54 @@
+module Masks
+  module Rails
+    class Renewal
+      OUTCOMES = %i[renewed refused unregistered unreachable].freeze
+
+      attr_reader :outcome, :tokens, :identity
+
+      class << self
+        def renewed(tokens, identity)
+          new(:renewed, tokens: tokens, identity: identity)
+        end
+
+        def refused
+          new(:refused)
+        end
+
+        def unregistered
+          new(:unregistered)
+        end
+
+        def unreachable
+          new(:unreachable)
+        end
+      end
+
+      def initialize(outcome, tokens: nil, identity: nil)
+        raise ArgumentError, "#{outcome.inspect} is not one of #{OUTCOMES.join(', ')}" unless OUTCOMES.include?(outcome)
+
+        @outcome = outcome
+        @tokens = tokens
+        @identity = identity
+      end
+
+      def to_h
+        { "outcome" => outcome.to_s, "tokens" => tokens&.to_h&.except("id_token"), "identity" => identity }
+      end
+
+      def self.from_h(body)
+        return unreachable unless body.is_a?(Hash)
+
+        outcome = OUTCOMES.find { |known| known.to_s == body["outcome"] }
+
+        return unreachable if outcome.nil? || outcome == :unreachable
+        return new(outcome) unless outcome == :renewed
+
+        tokens = Masks::Client::Tokens.from_h(body["tokens"])
+
+        return unreachable if tokens.nil? || tokens.access_token.to_s.empty?
+
+        renewed(tokens, body["identity"].is_a?(Hash) ? body["identity"] : nil)
+      end
+    end
+  end
+end