masks 0.10.0 → 0.12.0

data/lib/masks/rails/session_cookies.rb

@@ -0,0 +1,145 @@
+require "zlib"
+
+module Masks
+  module Rails
+    class SessionCookies
+      class Overflow < Masks::Client::Error; end
+
+      VERSION = "v1".freeze
+      PIECE = 3800
+      PIECES = 8
+      CIPHER = "aes-256-gcm".freeze
+      NONCE = 12
+      TAG = 16
+      PURPOSE = "masks session cookie".freeze
+      UNPACKED = PIECE * PIECES * 8
+
+      class << self
+        def seal(held, bound)
+          sealing = OpenSSL::Cipher.new(CIPHER).encrypt
+          sealing.key = key
+          nonce = SecureRandom.random_bytes(NONCE)
+          sealing.iv = nonce
+          sealing.auth_data = bound.to_s
+          body = sealing.update(Zlib::Deflate.deflate(JSON.generate(held))) + sealing.final
+
+          "#{VERSION}.#{Base64.urlsafe_encode64(nonce + sealing.auth_tag(TAG) + body, padding: false)}"
+        end
+
+        def open(value, bound)
+          version, sealed = value.to_s.split(".", 2)
+
+          return nil unless version == VERSION && sealed.present?
+
+          raw = Base64.urlsafe_decode64(sealed)
+
+          return nil if raw.bytesize < NONCE + TAG
+
+          opening = OpenSSL::Cipher.new(CIPHER).decrypt
+          opening.key = key
+          opening.iv = raw.byteslice(0, NONCE)
+          opening.auth_tag = raw.byteslice(NONCE, TAG)
+          opening.auth_data = bound.to_s
+          packed = opening.update(raw.byteslice((NONCE + TAG)..)) + opening.final
+          held = JSON.parse(inflated(packed))
+
+          held.is_a?(Hash) ? held : nil
+        rescue ArgumentError, OpenSSL::Cipher::CipherError, Zlib::Error, JSON::ParserError
+          nil
+        end
+
+        def key
+          ::Rails.application.key_generator.generate_key(PURPOSE, 32)
+        end
+
+        private
+
+          def inflated(packed)
+            inflater = Zlib::Inflate.new
+            held = +""
+
+            inflater.inflate(packed) do |chunk|
+              held << chunk
+              raise Zlib::DataError, "the session cookie unpacks to more than #{UNPACKED} bytes" if held.bytesize > UNPACKED
+            end
+
+            inflater.finish
+            held
+          ensure
+            inflater&.close
+          end
+      end
+
+      def initialize(request, key)
+        @request = request
+        @key = key
+      end
+
+      def read
+        bound = session[@key]
+        value = pieces.join
+
+        return nil if value.empty?
+
+        held = self.class.open(value, bound) if bound.is_a?(String)
+
+        clear_pieces if held.nil?
+        held
+      end
+
+      def write(held)
+        bound = session[@key]
+        bound = session[@key] = SecureRandom.hex(32) unless bound.is_a?(String)
+        value = self.class.seal(held, bound)
+        written = value.scan(/.{1,#{PIECE}}/o)
+
+        raise Overflow, "this session is #{value.bytesize} bytes, more than #{PIECES} cookies can hold" if written.size > PIECES
+
+        written.each_with_index { |piece, index| jar[name(index)] = options.merge(value: piece) }
+        (written.size...PIECES).each { |index| drop(name(index)) }
+      end
+
+      def clear
+        session.delete(@key)
+        clear_pieces
+      end
+
+      def name(index)
+        base = @request.ssl? ? "__Host-#{@key}" : @key.to_s
+
+        index.zero? ? base : "#{base}-#{index}"
+      end
+
+      private
+
+        def session
+          @request.session
+        end
+
+        def jar
+          @request.cookie_jar
+        end
+
+        def pieces
+          (0...PIECES).map { |index| jar[name(index)] }.take_while(&:present?)
+        end
+
+        def clear_pieces
+          (0...PIECES).each { |index| drop(name(index)) }
+        end
+
+        def drop(named)
+          jar.delete(named, path: "/", secure: @request.ssl?, same_site: :lax) if jar.key?(named)
+        end
+
+        def options
+          lifetime = @request.session_options[:expire_after] if @request.respond_to?(:session_options)
+
+          {
+            path: "/", httponly: true, secure: @request.ssl?, same_site: :lax,
+            expires: lifetime ? Time.now + lifetime : nil
+          }.compact
+        end
+    end
+  end
+end

data/lib/masks/rails.rb

@@ -13,10 +13,8 @@ module Masks
   # Three pieces do the work:
   #
   # [Configuration]    the issuer, credentials and routes, set once in an
-  #                    initializer and validated on boot rather than on the
-  #                    first request that needs them
-  # [Authentication]   +masks_login_url+, the callback, and the session the
-  #                    app reads +current_actor+ from
+  #                    initializer
+  # [Authentication]   +masks_login_url+, the callback, and the session
   # [ProtectedResource] the other direction — checking a bearer this app was
   #                    handed, for an API rather than a browser
   #
@@ -29,6 +27,9 @@ end
 require_relative "version"
 require_relative "client"
 require_relative "rails/credentials"
+require_relative "rails/renewal"
+require_relative "rails/cache"
+require_relative "rails/session_cookies"
 require_relative "rails/configuration"
 require_relative "rails/configurable"
 require_relative "rails/masked"

data/lib/masks/version.rb

@@ -1,3 +1,3 @@
 module Masks
-  VERSION = "0.10.0".freeze
+  VERSION = "0.12.0".freeze
 end

data/lib/masks.rb

@@ -8,7 +8,6 @@
 # defined, so requiring this gem outside \Rails costs nothing.
 #
 #   issuer = Masks::Client.issuer("https://auth.example")
-#   issuer.authorization_url(client_id: id, redirect_uri: uri)
 #
 # The provider itself is not in here. It is the masks-server gem, which runs
 # as an app of its own or mounted inside another Rails app.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: masks
 version: !ruby/object:Gem::Version
-  version: 0.10.0
+  version: 0.12.0
 platform: ruby
 authors:
 - the masks authors
@@ -50,12 +50,17 @@ files:
 - lib/masks/client/claims.rb
 - lib/masks/client/delegations.rb
 - lib/masks/client/delegations/fake.rb
+- lib/masks/client/device.rb
+- lib/masks/client/embedded.rb
+- lib/masks/client/enrollment.rb
 - lib/masks/client/errors.rb
 - lib/masks/client/handshake.rb
 - lib/masks/client/http.rb
 - lib/masks/client/introspection.rb
 - lib/masks/client/issuer.rb
+- lib/masks/client/key.rb
 - lib/masks/client/logout.rb
+- lib/masks/client/nonces.rb
 - lib/masks/client/pkce.rb
 - lib/masks/client/proof.rb
 - lib/masks/client/rack.rb
@@ -66,9 +71,11 @@ files:
 - lib/masks/client/stores.rb
 - lib/masks/client/tokens.rb
 - lib/masks/client/tracker.rb
+- lib/masks/client/transport.rb
 - lib/masks/client/verifier.rb
 - lib/masks/rails.rb
 - lib/masks/rails/authentication.rb
+- lib/masks/rails/cache.rb
 - lib/masks/rails/configurable.rb
 - lib/masks/rails/configuration.rb
 - lib/masks/rails/credentials.rb
@@ -76,6 +83,8 @@ files:
 - lib/masks/rails/masked.rb
 - lib/masks/rails/privileged.rb
 - lib/masks/rails/protected_resource.rb
+- lib/masks/rails/renewal.rb
+- lib/masks/rails/session_cookies.rb
 - lib/masks/version.rb
 homepage: https://github.com/masksrb/masks
 licenses: