masks 0.11.0 → 0.12.0

data/lib/masks/rails/configuration.rb

@@ -11,7 +11,7 @@ module Masks
                     :after_sign_out, :session_key, :sign_out_of_issuer, :parent_controller,
                     :credentials_path, :authenticate_everything, :delegates
       attr_writer :issuer, :redirect_uri, :name, :credentials, :store, :forget, :logged_out,
-                  :delegation_redirect_uri, :organization, :manages, :replay
+                  :delegation_redirect_uri, :organization, :manages, :cache
 
       def initialize
         @scope = Masks::Client::Session::DEFAULT_SCOPE
@@ -80,18 +80,13 @@ module Masks
       end
 
       def backchannel_logout_uri_for(request)
-        return nil unless @logged_out.respond_to?(:call)
-        return nil unless Masks::Client::Issuer.resolve(issuer_for(request)).backchannel_logout?
-
         "#{request.base_url}#{routes.backchannel_logout_path}"
       end
 
       def logged_out!(request, logout)
-        return false unless @logged_out.respond_to?(:call)
+        return unless @logged_out.respond_to?(:call)
 
         @logged_out.arity == 1 ? @logged_out.call(logout) : @logged_out.call(request, logout)
-
-        true
       end
 
       def manages?(request, masked = nil)
@@ -140,12 +135,18 @@ module Masks
           issuer: issuer_for(request),
           url: url,
           scopes: resource_scopes,
-          replay: replay
+          replay: Cache.new(cache)
         )
       end
 
-      def replay
-        @replay || Masks::Client::Proof.memory
+      def cache
+        return @cache if @cache
+
+        held = ::Rails.cache if ::Rails.respond_to?(:cache)
+
+        return held unless held.nil? || held.is_a?(ActiveSupport::Cache::NullStore)
+
+        @process_cache ||= ActiveSupport::Cache::MemoryStore.new
       end
 
       def handshake_for(request)
@@ -157,7 +158,8 @@ module Masks
           redirect_uris: [ redirect_uri_for(request), delegation_redirect_uri_for(request) ].compact.uniq,
           return_to: return_to_for(request),
           scope: approved_scope,
-          backchannel_logout_uri: backchannel_logout_uri_for(request)
+          backchannel_logout_uri: backchannel_logout_uri_for(request),
+          post_logout_redirect_uri: post_logout_redirect_uri_for(request)
         )
       end
 
@@ -194,14 +196,22 @@ module Masks
       end
 
       def return_to_for(request)
-        uri = URI.parse(redirect_uri_for(request))
-        port = ":#{uri.port}" unless uri.port == uri.default_port
+        "#{origin_for(request)}#{routes.handshake_callback_path}"
+      end
 
-        "#{uri.scheme}://#{uri.host}#{port}#{routes.handshake_callback_path}"
+      def post_logout_redirect_uri_for(request)
+        "#{origin_for(request)}#{routes.logout_return_path}"
       end
 
       private
 
+        def origin_for(request)
+          uri = URI.parse(redirect_uri_for(request))
+          port = ":#{uri.port}" unless uri.port == uri.default_port
+
+          "#{uri.scheme}://#{uri.host}#{port}"
+        end
+
         def routes
           Masks::Rails::Engine.routes.url_helpers
         end

data/lib/masks/rails/renewal.rb

@@ -0,0 +1,54 @@
+module Masks
+  module Rails
+    class Renewal
+      OUTCOMES = %i[renewed refused unregistered unreachable].freeze
+
+      attr_reader :outcome, :tokens, :identity
+
+      class << self
+        def renewed(tokens, identity)
+          new(:renewed, tokens: tokens, identity: identity)
+        end
+
+        def refused
+          new(:refused)
+        end
+
+        def unregistered
+          new(:unregistered)
+        end
+
+        def unreachable
+          new(:unreachable)
+        end
+      end
+
+      def initialize(outcome, tokens: nil, identity: nil)
+        raise ArgumentError, "#{outcome.inspect} is not one of #{OUTCOMES.join(', ')}" unless OUTCOMES.include?(outcome)
+
+        @outcome = outcome
+        @tokens = tokens
+        @identity = identity
+      end
+
+      def to_h
+        { "outcome" => outcome.to_s, "tokens" => tokens&.to_h&.except("id_token"), "identity" => identity }
+      end
+
+      def self.from_h(body)
+        return unreachable unless body.is_a?(Hash)
+
+        outcome = OUTCOMES.find { |known| known.to_s == body["outcome"] }
+
+        return unreachable if outcome.nil? || outcome == :unreachable
+        return new(outcome) unless outcome == :renewed
+
+        tokens = Masks::Client::Tokens.from_h(body["tokens"])
+
+        return unreachable if tokens.nil? || tokens.access_token.to_s.empty?
+
+        renewed(tokens, body["identity"].is_a?(Hash) ? body["identity"] : nil)
+      end
+    end
+  end
+end

data/lib/masks/rails/session_cookies.rb

@@ -0,0 +1,145 @@
+require "zlib"
+
+module Masks
+  module Rails
+    class SessionCookies
+      class Overflow < Masks::Client::Error; end
+
+      VERSION = "v1".freeze
+      PIECE = 3800
+      PIECES = 8
+      CIPHER = "aes-256-gcm".freeze
+      NONCE = 12
+      TAG = 16
+      PURPOSE = "masks session cookie".freeze
+      UNPACKED = PIECE * PIECES * 8
+
+      class << self
+        def seal(held, bound)
+          sealing = OpenSSL::Cipher.new(CIPHER).encrypt
+          sealing.key = key
+          nonce = SecureRandom.random_bytes(NONCE)
+          sealing.iv = nonce
+          sealing.auth_data = bound.to_s
+          body = sealing.update(Zlib::Deflate.deflate(JSON.generate(held))) + sealing.final
+
+          "#{VERSION}.#{Base64.urlsafe_encode64(nonce + sealing.auth_tag(TAG) + body, padding: false)}"
+        end
+
+        def open(value, bound)
+          version, sealed = value.to_s.split(".", 2)
+
+          return nil unless version == VERSION && sealed.present?
+
+          raw = Base64.urlsafe_decode64(sealed)
+
+          return nil if raw.bytesize < NONCE + TAG
+
+          opening = OpenSSL::Cipher.new(CIPHER).decrypt
+          opening.key = key
+          opening.iv = raw.byteslice(0, NONCE)
+          opening.auth_tag = raw.byteslice(NONCE, TAG)
+          opening.auth_data = bound.to_s
+          packed = opening.update(raw.byteslice((NONCE + TAG)..)) + opening.final
+          held = JSON.parse(inflated(packed))
+
+          held.is_a?(Hash) ? held : nil
+        rescue ArgumentError, OpenSSL::Cipher::CipherError, Zlib::Error, JSON::ParserError
+          nil
+        end
+
+        def key
+          ::Rails.application.key_generator.generate_key(PURPOSE, 32)
+        end
+
+        private
+
+          def inflated(packed)
+            inflater = Zlib::Inflate.new
+            held = +""
+
+            inflater.inflate(packed) do |chunk|
+              held << chunk
+              raise Zlib::DataError, "the session cookie unpacks to more than #{UNPACKED} bytes" if held.bytesize > UNPACKED
+            end
+
+            inflater.finish
+            held
+          ensure
+            inflater&.close
+          end
+      end
+
+      def initialize(request, key)
+        @request = request
+        @key = key
+      end
+
+      def read
+        bound = session[@key]
+        value = pieces.join
+
+        return nil if value.empty?
+
+        held = self.class.open(value, bound) if bound.is_a?(String)
+
+        clear_pieces if held.nil?
+        held
+      end
+
+      def write(held)
+        bound = session[@key]
+        bound = session[@key] = SecureRandom.hex(32) unless bound.is_a?(String)
+        value = self.class.seal(held, bound)
+        written = value.scan(/.{1,#{PIECE}}/o)
+
+        raise Overflow, "this session is #{value.bytesize} bytes, more than #{PIECES} cookies can hold" if written.size > PIECES
+
+        written.each_with_index { |piece, index| jar[name(index)] = options.merge(value: piece) }
+        (written.size...PIECES).each { |index| drop(name(index)) }
+      end
+
+      def clear
+        session.delete(@key)
+        clear_pieces
+      end
+
+      def name(index)
+        base = @request.ssl? ? "__Host-#{@key}" : @key.to_s
+
+        index.zero? ? base : "#{base}-#{index}"
+      end
+
+      private
+
+        def session
+          @request.session
+        end
+
+        def jar
+          @request.cookie_jar
+        end
+
+        def pieces
+          (0...PIECES).map { |index| jar[name(index)] }.take_while(&:present?)
+        end
+
+        def clear_pieces
+          (0...PIECES).each { |index| drop(name(index)) }
+        end
+
+        def drop(named)
+          jar.delete(named, path: "/", secure: @request.ssl?, same_site: :lax) if jar.key?(named)
+        end
+
+        def options
+          lifetime = @request.session_options[:expire_after] if @request.respond_to?(:session_options)
+
+          {
+            path: "/", httponly: true, secure: @request.ssl?, same_site: :lax,
+            expires: lifetime ? Time.now + lifetime : nil
+          }.compact
+        end
+    end
+  end
+end

data/lib/masks/rails.rb

@@ -13,10 +13,8 @@ module Masks
   # Three pieces do the work:
   #
   # [Configuration]    the issuer, credentials and routes, set once in an
-  #                    initializer and validated on boot rather than on the
-  #                    first request that needs them
-  # [Authentication]   +masks_login_url+, the callback, and the session the
-  #                    app reads +current_actor+ from
+  #                    initializer
+  # [Authentication]   +masks_login_url+, the callback, and the session
   # [ProtectedResource] the other direction — checking a bearer this app was
   #                    handed, for an API rather than a browser
   #
@@ -29,6 +27,9 @@ end
 require_relative "version"
 require_relative "client"
 require_relative "rails/credentials"
+require_relative "rails/renewal"
+require_relative "rails/cache"
+require_relative "rails/session_cookies"
 require_relative "rails/configuration"
 require_relative "rails/configurable"
 require_relative "rails/masked"

data/lib/masks/version.rb

@@ -1,3 +1,3 @@
 module Masks
-  VERSION = "0.11.0".freeze
+  VERSION = "0.12.0".freeze
 end

data/lib/masks.rb

@@ -8,7 +8,6 @@
 # defined, so requiring this gem outside \Rails costs nothing.
 #
 #   issuer = Masks::Client.issuer("https://auth.example")
-#   issuer.authorization_url(client_id: id, redirect_uri: uri)
 #
 # The provider itself is not in here. It is the masks-server gem, which runs
 # as an app of its own or mounted inside another Rails app.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: masks
 version: !ruby/object:Gem::Version
-  version: 0.11.0
+  version: 0.12.0
 platform: ruby
 authors:
 - the masks authors
@@ -75,6 +75,7 @@ files:
 - lib/masks/client/verifier.rb
 - lib/masks/rails.rb
 - lib/masks/rails/authentication.rb
+- lib/masks/rails/cache.rb
 - lib/masks/rails/configurable.rb
 - lib/masks/rails/configuration.rb
 - lib/masks/rails/credentials.rb
@@ -82,6 +83,8 @@ files:
 - lib/masks/rails/masked.rb
 - lib/masks/rails/privileged.rb
 - lib/masks/rails/protected_resource.rb
+- lib/masks/rails/renewal.rb
+- lib/masks/rails/session_cookies.rb
 - lib/masks/version.rb
 homepage: https://github.com/masksrb/masks
 licenses: