masks 0.11.0 → 0.12.0

data/app/controllers/masks/rails/sessions_controller.rb

@@ -3,6 +3,9 @@ module Masks
     class SessionsController < BaseController
       RESTARTED = "masks_restarted_at".freeze
       RESTART_WITHIN = 60
+      SAME_ORIGIN = %w[same-origin none].freeze
+
+      before_action :refuse_cross_site, only: :destroy
 
       def show
         if masks_configured? && (masks_signed_in? || (masks_tokens && masks_refresh!))
@@ -10,7 +13,7 @@ module Masks
 
           render json: masked.to_h
         else
-          masks_forget
+          masks_forget unless masks_configured?
           masks_refuse_json
         end
       end
@@ -40,7 +43,8 @@ module Masks
       def callback
         pending = masks_requests.claim(params[:state])
 
-        return refuse(params[:error], params[:error_description], pending) if params[:error].present?
+        return refuse(params[:error], params[:error_description], pending) if params[:error].present? && pending
+        return unstarted if params[:error].present?
         return stale if pending.nil?
 
         tokens = masks_session.complete(
@@ -83,15 +87,42 @@ module Masks
         if masks_wants_json?
           render json: { "signed_in" => false, "logout_url" => upstream }.compact
         else
-          redirect_to upstream || masks_config.after_sign_out, allow_other_host: upstream.present?
+          redirect_to upstream || masks_after_sign_out_path, allow_other_host: upstream.present?
         end
       end
 
+      def signed_out
+        return stale_sign_out if masks_farewells.claim(params[:state].to_s).nil?
+
+        redirect_to masks_after_sign_out_path
+      end
+
       private
 
+        def refuse_cross_site
+          return if same_origin?
+
+          answer("invalid_request", "that request came from another site", :forbidden, failed: "sign-out")
+        end
+
+        def same_origin?
+          site = request.headers["Sec-Fetch-Site"].to_s
+
+          return false unless site.empty? || SAME_ORIGIN.include?(site)
+
+          sent = request.headers["Origin"].to_s
+
+          sent.empty? || [ request.base_url, own_origin ].include?(sent)
+        end
+
+        def own_origin
+          URI.join(masks_config.redirect_uri_for(request), "/").to_s.chomp("/")
+        end
+
         def renew_session
           carried = session.to_hash.slice(REQUESTS, HANDSHAKES, Masks::Rails::Authentication::STEPPED_UP)
 
+          masks_forget
           reset_session
           carried.each { |key, value| session[key] = value }
         end
@@ -130,6 +161,16 @@ module Masks
           )
         end
 
+        def unstarted
+          answer("invalid_state", "masks refused a sign-in that this browser did not start, or one that expired",
+                 :bad_request)
+        end
+
+        def stale_sign_out
+          answer("invalid_state", "that sign-out is not one this browser started, or it expired", :bad_request,
+                 failed: "sign-out")
+        end
+
         def restart
           session[RESTARTED] = Time.now.to_i
           redirect_to start_path
@@ -145,11 +186,11 @@ module Masks
           answer(code, description, :bad_request)
         end
 
-        def answer(code, description, status)
+        def answer(code, description, status, failed: "sign-in")
           if masks_wants_json?
             render json: { "error" => code, "error_description" => description }, status: status
           else
-            render plain: "sign-in failed — #{code}: #{description}", status: status
+            render plain: "#{failed} failed — #{code}: #{description}", status: status
           end
         end
     end

data/config/routes.rb

@@ -4,6 +4,7 @@ Masks::Rails::Engine.routes.draw do
   get "/avatar", to: "avatars#show", as: :avatar
   get "/callback", to: "sessions#callback", as: :callback
   match "/logout", to: "sessions#destroy", via: %i[get post delete], as: :logout
+  get "/logout/return", to: "sessions#signed_out", as: :logout_return
   post "/logout/backchannel", to: "logouts#create", as: :backchannel_logout
 
   get "/handshake", to: "handshakes#show", as: :handshake

data/lib/masks/client/embedded.rb

@@ -74,7 +74,7 @@ module Masks
             "SERVER_PORT" => uri.port.to_s,
             "SERVER_PROTOCOL" => "HTTP/1.1",
             "REMOTE_ADDR" => LOOPBACK,
-            "HTTP_HOST" => uri.port == uri.default_port ? uri.host : "#{uri.host}:#{uri.port}",
+            "HTTP_HOST" => Nonces.origin(uri).delete_prefix("#{uri.scheme}://"),
             "HTTPS" => uri.scheme == "https" ? "on" : "off",
             "rack.url_scheme" => uri.scheme,
             "rack.input" => StringIO.new(input),

data/lib/masks/client/handshake.rb

@@ -6,17 +6,22 @@ module Masks
       AUTH_METHOD = "client_secret_basic".freeze
 
       attr_reader :issuer, :name, :resource, :redirect_uris, :scope, :return_to,
-                  :backchannel_logout_uri
+                  :post_logout_redirect_uri
 
       def initialize(issuer, name:, resource:, redirect_uris:, return_to:,
-                     scope: Session::DEFAULT_SCOPE, backchannel_logout_uri: nil)
+                     scope: Session::DEFAULT_SCOPE, backchannel_logout_uri: nil, post_logout_redirect_uri: nil)
         @issuer = Issuer.resolve(issuer)
         @name = name.to_s
         @resource = resource.to_s
         @redirect_uris = Array(redirect_uris).map(&:to_s)
         @scope = Array(scope).flat_map { |value| value.to_s.split(/\s+/) }.reject(&:empty?)
         @return_to = return_to.to_s
-        @backchannel_logout_uri = backchannel_logout_uri&.to_s
+        @backchannel_logout_uri = backchannel_logout_uri.to_s if present?(backchannel_logout_uri)
+        @post_logout_redirect_uri = post_logout_redirect_uri.to_s if present?(post_logout_redirect_uri)
+      end
+
+      def backchannel_logout_uri
+        @backchannel_logout_uri if @backchannel_logout_uri && issuer.backchannel_logout?
       end
 
       def endpoint
@@ -36,7 +41,10 @@ module Masks
           [ "state", state ]
         ]
 
-        query << [ "backchannel_logout_uri", backchannel_logout_uri ] if backchannel_logout_uri
+        backchannel = backchannel_logout_uri
+
+        query << [ "backchannel_logout_uri", backchannel ] if backchannel
+        query << [ "post_logout_redirect_uri", post_logout_redirect_uri ] if post_logout_redirect_uri
         redirect_uris.each { |uri| query << [ "redirect_uris", uri ] }
 
         "#{endpoint}?#{URI.encode_www_form(query)}"

data/lib/masks/client/http.rb

@@ -4,6 +4,7 @@ module Masks
       OPEN_TIMEOUT = 5
       READ_TIMEOUT = 10
       READ_LIMIT = 1 << 20
+      FETCH_LIMIT = 8 << 20
 
       module_function
 
@@ -43,19 +44,7 @@ module Masks
       end
 
       def fetch(url, headers = {})
-        uri = checked(URI.parse(url.to_s))
-        embedded = Masks::Client.embedded_for(uri)
-
-        return embedded.deliver(Net::HTTP::Get.new(uri, headers)) if embedded
-
-        Net::HTTP.start(
-          uri.hostname, uri.port,
-          use_ssl: uri.scheme == "https",
-          open_timeout: OPEN_TIMEOUT,
-          read_timeout: READ_TIMEOUT
-        ) { |http| http.request(Net::HTTP::Get.new(uri, headers)) }
-      rescue SystemCallError, SocketError, Net::OpenTimeout, Net::ReadTimeout, OpenSSL::SSL::SSLError => e
-        raise Unreachable, "#{uri.host} is unreachable (#{e.class})"
+        deliver(Net::HTTP::Get.new(checked(URI.parse(url.to_s)), headers), limit: FETCH_LIMIT)
       end
 
       def json(verb, url, body, headers)

data/lib/masks/client/logout.rb

@@ -9,7 +9,7 @@ module Masks
         def verify(token, issuer:, audience:, algorithms: ALGORITHMS)
           held = Verifier
             .new(issuer, audience: audience, algorithms: algorithms)
-            .verify(token, required: %w[iss aud iat jti events], typ: Verifier::LOGOUT_TOKEN)
+            .verify(token, required: %w[iss aud iat exp jti events], typ: Verifier::LOGOUT_TOKEN)
 
           new(held).validate!
         end
@@ -37,6 +37,10 @@ module Masks
         Time.at(claims["iat"].to_i).utc
       end
 
+      def expires_at
+        Time.at(claims["exp"].to_i).utc
+      end
+
       def validate!
         refuse!("logout token carries a nonce, so it is an id token") if claims.key?("nonce")
         refuse!("logout token names neither a subject nor a session") if subject.nil? && sid.nil?

data/lib/masks/client/resource.rb

@@ -57,7 +57,7 @@ module Masks
 
         parameters = [
           [ "error", error.code ],
-          [ "error_description", error.description ],
+          [ "error_description", (error.description if error.code) ],
           [ "scope", error.scope || (scopes.join(" ") if scopes.any?) ],
           [ "resource_metadata", metadata_url ]
         ]

data/lib/masks/client/verifier.rb

@@ -28,8 +28,16 @@ module Masks
         typed!(header["typ"], Array(typ))
 
         claims
-      rescue JWT::DecodeError => e
-        raise InvalidToken, e.message
+      rescue JWT::ExpiredSignature
+        raise InvalidToken, "that token has expired"
+      rescue JWT::InvalidIssuerError
+        raise InvalidToken, "that token was issued by another server"
+      rescue JWT::InvalidAudError
+        raise InvalidToken, "that token was issued for another app"
+      rescue JWT::MissingRequiredClaim
+        raise InvalidToken, "that token is missing a claim it needs"
+      rescue JWT::DecodeError
+        raise InvalidToken, "that token was not signed by #{issuer.url}"
       end
 
       private

data/lib/masks/client.rb

@@ -46,9 +46,6 @@ module Masks
   # [verifier]  an API checking a bearer it was handed
   # [resource]  an API publishing what it is and which scopes it takes
   # [handshake] an app registering itself, once, without a copied secret
-  #
-  # Everything reachable from here talks HTTP to a masks issuer and holds no
-  # state of its own beyond the discovery cache in ::registry.
   module Client
     class << self
       attr_writer :plain_http
@@ -78,7 +75,6 @@ module Masks
       # cheap after the first.
       #
       #   issuer = Masks::Client.issuer("https://auth.example")
-      #   issuer.authorization_url(client_id: id, redirect_uri: uri)
       #
       # @return [Masks::Client::Issuer]
       def issuer(url, **options)

data/lib/masks/rails/authentication.rb

@@ -9,6 +9,10 @@ module Masks
         if respond_to?(:helper_method)
           helper_method :masked, :masks_login_url
         end
+
+        if respond_to?(:rescue_from) && method_defined?(:render)
+          rescue_from Masks::Rails::Cache::Unavailable, with: :masks_cache_unavailable
+        end
       end
 
       REQUESTS = "masks_requests".freeze
@@ -40,24 +44,42 @@ module Masks
       def masks_tokens
         return @masks_tokens if defined?(@masks_tokens)
 
-        @masks_tokens = Masks::Client::Tokens.from_h(session[masks_config.session_key])
+        held = masks_held
+
+        if held.present? && masks_departed?(held)
+          masks_forget
+          return nil
+        end
+
+        @masks_tokens = Masks::Client::Tokens.from_h(held)
+      end
+
+      def masks_cache
+        @masks_cache ||= Masks::Rails::Cache.new(masks_config.cache)
       end
 
       def masks_store(tokens, identity: nil)
         held = tokens.to_h.except("id_token")
+        held.delete("token_type") if held["token_type"] == "Bearer"
         held["identity"] = identity&.slice(*IDENTITY) || masks_held["identity"]
+        held["signed_in_at"] = masks_held["signed_in_at"] || Masks::Rails::Cache.now
 
-        session[masks_config.session_key] = held.compact
+        masks_session_cookies.write(held.compact)
+        @masks_held = held.compact
         @masks_tokens = tokens
         @masked = nil
       end
 
       def masks_held
-        session[masks_config.session_key] || {}
+        @masks_held ||= masks_session_cookies.read || {}
+      end
+
+      def masks_session_cookies
+        Masks::Rails::SessionCookies.new(request, masks_config.session_key)
       end
 
       IDENTITY = [
-        "sub", "name", "preferred_username", "email", "email_verified", "tenant",
+        "sub", "sid", "name", "preferred_username", "email", "email_verified", "tenant",
         "picture", Masks::Client::Claims::AVATARS, Masks::Client::Claims::ORGANIZATION,
         Masks::Client::Claims::ORGANIZATIONS
       ].freeze
@@ -69,7 +91,8 @@ module Masks
       end
 
       def masks_forget
-        session.delete(masks_config.session_key)
+        masks_session_cookies.clear
+        @masks_held = {}
         @masks_tokens = nil
         @masked = nil
       end
@@ -129,22 +152,34 @@ module Masks
       end
 
       def masks_refresh!
-        return false unless masks_configured?
-        return false if masks_tokens&.refresh_token.nil?
+        return false unless masks_configured? && masks_tokens
 
-        refreshed = masks_session.refresh(
-          masks_tokens.refresh_token,
-          resource: masks_config.resource_for(request)
-        )
+        spent = masks_tokens.refresh_token
 
-        masks_store(refreshed, identity: masks_refreshed_identity(refreshed))
-        true
-      rescue Masks::Client::Unregistered
-        masks_disconnect!
-        false
-      rescue Masks::Client::Rejected
-        masks_forget
-        false
+        if spent.nil?
+          masks_forget
+          return false
+        end
+
+        renewal = begin
+          masks_cache.renew(masks_config.issuer_for(request).to_s, spent) { masks_renewal(spent) }
+        rescue Masks::Rails::Cache::Unavailable
+          Masks::Rails::Renewal.unreachable
+        end
+
+        case renewal.outcome
+        when :renewed
+          masks_store(renewal.tokens, identity: renewal.identity)
+          true
+        when :unregistered
+          masks_disconnect!
+          false
+        when :refused
+          masks_forget
+          false
+        else
+          false
+        end
       end
 
       def masks_refreshed_identity(tokens)
@@ -154,18 +189,9 @@ module Masks
 
         profile = masks_session.profile(tokens)
 
-        profile.empty? ? nil : held.merge(profile.slice(*IDENTITY))
-      end
-
-      def masks_logout_url(state:)
-        return nil unless masks_configured?
+        return nil if profile.empty? || profile["sub"].to_s != held["sub"].to_s
 
-        masks_session.end_session_url(
-          post_logout_redirect_uri: masks_config.return_to_for(request),
-          state: state
-        )
-      rescue Masks::Client::Error
-        nil
+        held.merge(profile.slice(*IDENTITY))
       end
 
       def masks_login_url(return_to: nil, organization: nil, privilege: nil)
@@ -194,14 +220,41 @@ module Masks
 
       private
 
+        def masks_departed?(held)
+          identity = held["identity"]
+
+          return false unless identity.is_a?(Hash)
+
+          masks_cache.departed?(masks_config.issuer_for(request).to_s, identity, since: held["signed_in_at"].to_i)
+        rescue Masks::Rails::Configuration::Unconfigured
+          false
+        end
+
+        def masks_renewal(spent)
+          refreshed = masks_session.refresh(spent, resource: masks_config.resource_for(request))
+          refreshed = Masks::Client::Tokens.from_h(refreshed.to_h.merge("refresh_token" => spent)) if refreshed.refresh_token.nil?
+
+          Masks::Rails::Renewal.renewed(refreshed, masks_refreshed_identity(refreshed))
+        rescue Masks::Client::Unregistered
+          Masks::Rails::Renewal.unregistered
+        rescue Masks::Client::Rejected => e
+          e.status.to_i >= 500 || e.status.to_i == 429 ? Masks::Rails::Renewal.unreachable : Masks::Rails::Renewal.refused
+        rescue Masks::Client::Error
+          Masks::Rails::Renewal.unreachable
+        end
+
         def masks_sign_out_upstream
           return nil unless masks_configured?
 
           farewell = masks_farewells.open
-          url = masks_logout_url(state: farewell.id)
 
-          masks_farewells.clear! if url.nil?
-          url
+          masks_session.end_session_url(
+            post_logout_redirect_uri: masks_config.post_logout_redirect_uri_for(request),
+            state: farewell.id
+          )
+        rescue Masks::Client::Error
+          masks_farewells.clear!
+          nil
         end
 
         def masks_after_sign_out_path
@@ -268,6 +321,18 @@ module Masks
           redirect_to Masks::Rails::Engine.routes.url_helpers.start_path
         end
 
+        def masks_cache_unavailable(error)
+          response.headers["Cache-Control"] = "no-store"
+          response.headers["Retry-After"] = "5"
+
+          if masks_wants_json?
+            render json: { "error" => "temporarily_unavailable", "error_description" => error.message },
+                   status: :service_unavailable
+          else
+            render plain: "Signing in is unavailable right now. Try again in a moment.", status: :service_unavailable
+          end
+        end
+
         def masks_refuse_json
           response.headers["Cache-Control"] = "no-store"
 

data/lib/masks/rails/cache.rb

@@ -0,0 +1,173 @@
+module Masks
+  module Rails
+    class Cache
+      class Unavailable < Masks::Client::Error; end
+
+      CLAIM = 30
+      RESULT = 60
+      WAIT = 0.05
+      PATIENCE = 30
+      LOGOUT = 600
+      LOGOUT_LEEWAY = 120
+      DEPARTURE = 30 * 24 * 3600
+      CIPHER = "aes-256-gcm".freeze
+      NONCE = 12
+      TAG = 16
+
+      def self.key(*parts)
+        "masks:#{OpenSSL::Digest::SHA256.hexdigest(parts.map(&:to_s).join("\0"))}"
+      end
+
+      def self.now
+        (Time.now.to_f * 1000).to_i
+      end
+
+      attr_reader :store
+
+      def initialize(store)
+        @store = store
+      end
+
+      def first?(key, expires_in:)
+        add(self.class.key("proof", key), expires_in)
+      end
+
+      def first_logout?(issuer, logout)
+        add(self.class.key("logout", issuer, logout.jti), logout_memory(logout))
+      end
+
+      def depart!(issuer, logout)
+        kind, value = logout.sid.to_s.empty? ? [ "sub", logout.subject ] : [ "sid", logout.sid ]
+
+        kept = begin
+          write(self.class.key("departed", issuer, kind, value), self.class.now, expires_in: DEPARTURE)
+        rescue Unavailable
+          false
+        end
+
+        return if kept
+
+        forgotten { delete(self.class.key("logout", issuer, logout.jti)) }
+
+        raise Unavailable, "the cache did not keep that logout"
+      end
+
+      def departed?(issuer, identity, since:)
+        [ [ "sid", identity["sid"] ], [ "sub", identity["sub"] ] ].any? do |kind, value|
+          next false if value.to_s.empty?
+
+          at = read(self.class.key("departed", issuer, kind, value))
+
+          at.is_a?(Integer) && at >= since
+        end
+      end
+
+      def renew(issuer, refresh_token)
+        result = self.class.key("refreshed", issuer, refresh_token)
+        claim = self.class.key("refreshing", issuer, refresh_token)
+        found = opened(result, refresh_token)
+
+        return found if found
+        return awaited(result, claim, refresh_token) unless add(claim, CLAIM)
+
+        begin
+          held = yield
+
+          forgotten { write(result, sealed(refresh_token, held), expires_in: RESULT) } unless held.outcome == :unreachable
+
+          held
+        ensure
+          forgotten { delete(claim) }
+        end
+      end
+
+      private
+
+        def add(key, expires_in)
+          return true if write(key, 1, unless_exist: true, expires_in: expires_in)
+          return false unless read(key).nil?
+
+          raise Unavailable, "the cache neither kept that key nor holds it, so it is not answering"
+        end
+
+        def read(key)
+          reached { store.read(key) }
+        end
+
+        def write(key, value, **options)
+          reached { store.write(key, value, **options) }
+        end
+
+        def delete(key)
+          reached { store.delete(key) }
+        end
+
+        def reached
+          yield
+        rescue Unavailable
+          raise
+        rescue StandardError => e
+          raise Unavailable, "the cache could not be reached (#{e.class})"
+        end
+
+        def forgotten
+          yield
+        rescue Unavailable
+          nil
+        end
+
+        def logout_memory(logout)
+          [ LOGOUT, logout.expires_at.to_i - Time.now.to_i + LOGOUT_LEEWAY ].max
+        end
+
+        def awaited(result, claim, refresh_token)
+          deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + PATIENCE
+
+          while Process.clock_gettime(Process::CLOCK_MONOTONIC) < deadline
+            sleep WAIT
+
+            found = opened(result, refresh_token)
+
+            return found if found
+            return opened(result, refresh_token) || Renewal.unreachable if read(claim).nil?
+          end
+
+          Renewal.unreachable
+        end
+
+        def cipher(mode, refresh_token)
+          held = OpenSSL::Cipher.new(CIPHER).public_send(mode)
+          held.key = OpenSSL::KDF.hkdf(refresh_token.to_s, salt: "masks", info: "masks/rails shared refresh",
+                                                           length: 32, hash: "SHA256")
+          held
+        end
+
+        def sealed(refresh_token, held)
+          plain = JSON.generate(held.to_h)
+          sealing = cipher(:encrypt, refresh_token)
+          nonce = SecureRandom.random_bytes(NONCE)
+          sealing.iv = nonce
+          sealing.auth_data = ""
+          body = sealing.update(plain) + sealing.final
+
+          Base64.strict_encode64(nonce + sealing.auth_tag(TAG) + body)
+        end
+
+        def opened(result, refresh_token)
+          held = read(result)
+
+          return nil if held.nil?
+
+          raw = Base64.strict_decode64(held.to_s)
+          opening = cipher(:decrypt, refresh_token)
+          opening.iv = raw.byteslice(0, NONCE)
+          opening.auth_tag = raw.byteslice(NONCE, TAG)
+          opening.auth_data = ""
+
+          Renewal.from_h(JSON.parse(opening.update(raw.byteslice((NONCE + TAG)..).to_s) + opening.final))
+        rescue ArgumentError, TypeError, OpenSSL::Cipher::CipherError, JSON::ParserError
+          Renewal.unreachable
+        end
+    end
+  end
+end