masks 0.12.0 → 0.12.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 22811283549c975e2550ab8546760831275db1efa68ddfd16ebe1dcfb96278a5
-  data.tar.gz: 888decf6ea332f751cb446a4e7535313527141ed64086cbf62acc2787d320a9b
+  metadata.gz: 638e4da3d119c8e1841e1d8f4d87742133ac14ef28c8b1f7dbbdd55725913974
+  data.tar.gz: 5c704c90104b9fa581948029a2897e40e1e69f66573739f33aa6c3b7ceae14d4
 SHA512:
-  metadata.gz: 33275896c9010d94818885f7a0a3f71b83f6782af7384cf29fb70d482b03492b8e662f27d6f748e1d9a05f453f5294dc910ca5d1492395c7bc3e0bc57aaaea6f
-  data.tar.gz: 5fb2c1d80a01a0723c3533bc8861cca4c2d0761e9ef5d4ef21f46de41d611835bf9fefe28ac0bab860b65bb0ee166cf8288fbda1a178644f58dc3a850edaea96
+  metadata.gz: 97f6edc170dc1544af96fa847f7513a547a39422fffa2435c44f8073bcfaaaf205bf60ed4fc1f1bf82b50c968e9b21e7ff88558fc2042039df5be4ab332b8174
+  data.tar.gz: f0c0b5d58b797556ef18dffdf3a81b09e9f94407c68da642950c4578639376a109064b3efbb24d5c802edef0c138a2f079002229f35d9ae520bc2c98ff0c5439

data/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [0.12.2](https://github.com/masksrb/masks/compare/gem/v0.12.1...gem/v0.12.2) (2026-10-20)
+
+
+### Fixes
+
+* **client:** a sign-in older than the max_age the app asked for is refused ([7116e24](https://github.com/masksrb/masks/commit/7116e24e73dedcca6ce54aa4347100b7d4714e3a)), closes [#161](https://github.com/masksrb/masks/issues/161)
+* **client:** the last good issuer and keys are served while masks is down ([1423d1e](https://github.com/masksrb/masks/commit/1423d1ea6b7968aa66ad2a2ca63180effa4c1002)), closes [#162](https://github.com/masksrb/masks/issues/162)
+
+## [0.12.1](https://github.com/masksrb/masks/compare/gem/v0.12.0...gem/v0.12.1) (2026-10-19)
+
+
+### Fixes
+
+* **client:** a Rails sign-out link followed by a browser that names no site asks before signing out ([c62c6c1](https://github.com/masksrb/masks/commit/c62c6c1854bb2f7a60339468f6db1b408d6786b9))
+* **client:** one Rails guard decides where a sign-out came from, so a POST that names no site is refused and the Sign out page carries everywhere in its address ([ed86c45](https://github.com/masksrb/masks/commit/ed86c45692dc4d8a0614697ccc832fe1358bd58d))
+
 ## [0.12.0](https://github.com/masksrb/masks/compare/gem/v0.11.0...gem/v0.12.0) (2026-10-14)
 
 

data/app/controllers/masks/rails/sessions_controller.rb

@@ -4,8 +4,14 @@ module Masks
       RESTARTED = "masks_restarted_at".freeze
       RESTART_WITHIN = 60
       SAME_ORIGIN = %w[same-origin none].freeze
+      CONFIRMATION_HEADERS = {
+        "Cache-Control" => "no-store",
+        "X-Content-Type-Options" => "nosniff",
+        "X-Frame-Options" => "DENY",
+        "Content-Security-Policy" => "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'"
+      }.freeze
 
-      before_action :refuse_cross_site, only: :destroy
+      before_action :require_this_site, only: :destroy
 
       def show
         if masks_configured? && (masks_signed_in? || (masks_tokens && masks_refresh!))
@@ -29,12 +35,13 @@ module Masks
           state: pending.id,
           resource: masks_config.resource_for(request),
           scope: masks_config.scope_for(params[:privilege]),
+          max_age: (params[:max_age].to_i if params[:max_age].to_i.positive?),
           organization: Masks::Client::Session.organization_key(params[:organization]) ||
             masks_config.organization_for(request)
         )
 
         masks_requests.amend(
-          pending.id, nonce: started[:nonce], verifier: started[:verifier]
+          pending.id, nonce: started[:nonce], verifier: started[:verifier], max_age: started[:max_age]
         )
 
         redirect_to started[:url], allow_other_host: true
@@ -63,6 +70,10 @@ module Masks
           return refuse("invalid_nonce", "the id token was issued for another request", pending)
         end
 
+        unless recent?(identity, pending[:max_age])
+          return refuse("invalid_token", "the person signed in longer ago than max_age allows", pending)
+        end
+
         renew_session
         masks_store(tokens, identity: identity)
 
@@ -99,20 +110,29 @@ module Masks
 
       private
 
-        def refuse_cross_site
-          return if same_origin?
+        def require_this_site
+          from = provenance
+          return if from == :this_site
 
-          answer("invalid_request", "that request came from another site", :forbidden, failed: "sign-out")
-        end
+          if from == :elsewhere || request.post? || request.delete?
+            return answer("invalid_request", "that request came from another site", :forbidden, failed: "sign-out")
+          end
 
-        def same_origin?
-          site = request.headers["Sec-Fetch-Site"].to_s
+          return answer("invalid_request", "sign out with a POST from this site", :forbidden) if masks_wants_json?
 
-          return false unless site.empty? || SAME_ORIGIN.include?(site)
+          @action = logout_path(request.query_parameters.slice("everywhere"))
+          response.headers.merge!(CONFIRMATION_HEADERS)
+          render :confirm, formats: :html
+        end
 
+        def provenance
+          site = request.headers["Sec-Fetch-Site"].to_s
           sent = request.headers["Origin"].to_s
 
-          sent.empty? || [ request.base_url, own_origin ].include?(sent)
+          return :elsewhere unless site.empty? || SAME_ORIGIN.include?(site)
+          return :elsewhere unless sent.empty? || [ request.base_url, own_origin ].include?(sent)
+
+          site.empty? && sent.empty? ? :unproven : :this_site
         end
 
         def own_origin
@@ -141,6 +161,13 @@ module Masks
           masks_local_path(params[:return_to])
         end
 
+        def recent?(identity, max_age)
+          Masks::Client::Verifier.recent!(identity.is_a?(Hash) ? identity : {}, max_age)
+          true
+        rescue Masks::Client::InvalidToken
+          false
+        end
+
         def nonce_matches?(identity, sent)
           return false if identity == :unverified
           return true if sent.blank?

data/app/views/masks/rails/sessions/confirm.html.erb

@@ -0,0 +1,9 @@
+<% content_for :title, "Sign out" %>
+
+<h1>Sign out</h1>
+
+<p>Select Sign out to finish signing out.</p>
+
+<%= form_with url: @action, method: :post do %>
+  <button type="submit">Sign out</button>
+<% end %>

data/lib/masks/client/issuer.rb

@@ -1,8 +1,15 @@
 module Masks
   module Client
+    # One issuer's discovery document and keys, fetched once and kept for an
+    # hour. While masks cannot be reached, the last good copies are served, a
+    # token signed with a key never seen raises Unreachable, and refetches back
+    # off from 5 seconds to once a minute.
     class Issuer
       DISCOVERY_PATH = "/.well-known/openid-configuration".freeze
-      TTL = 300
+      LIFETIME = 3600
+      FIRST_BACKOFF = 5
+      LONGEST_BACKOFF = 60
+      TTL = LIFETIME
 
       def self.normalize(url)
         url.to_s.chomp("/")
@@ -44,6 +51,10 @@ module Masks
         fetch(:jwks) { HTTP.get(endpoint("jwks_uri")) }
       end
 
+      def keys!
+        fetch(:jwks, now: true) { HTTP.get(endpoint("jwks_uri")) }
+      end
+
       def tenant
         discovery["tenant"]
       end
@@ -73,24 +84,41 @@ module Masks
       end
 
       def refresh!
-        @lock.synchronize { @cache = {} }
+        @lock.synchronize { @cache.each_value { |held| held[:at] = 0 } }
         self
       end
 
       private
 
-        def fetch(key)
-          cached = @lock.synchronize { @cache[key] }
-          return cached[:value] if fresh?(cached)
+        def fetch(key, now: false, &fetching)
+          held = @lock.synchronize { @cache[key] ||= { backoff: FIRST_BACKOFF, retry_at: 0 } }
+          clock = Time.now.to_i
+          good = held.key?(:value)
+
+          return held[:value] if good && !now && (held[:at] + @ttl > clock || clock < held[:retry_at])
+          raise held[:failure] if clock < held[:retry_at]
+
+          refetch(held, clock, keep: good && !now, &fetching)
+        end
 
+        def refetch(held, clock, keep:)
           value = yield
 
-          @lock.synchronize { @cache[key] = { value: value, at: Time.now.to_i } }
+          @lock.synchronize do
+            held.merge!(value: value, at: clock, failure: nil, retry_at: 0, backoff: FIRST_BACKOFF)
+          end
+
           value
-        end
+        rescue Masks::Client::Error => e
+          @lock.synchronize do
+            held[:failure] = e
+            held[:retry_at] = clock + held[:backoff]
+            held[:backoff] = [ held[:backoff] * 2, LONGEST_BACKOFF ].min
+          end
+
+          raise e unless keep
 
-        def fresh?(entry)
-          entry && entry[:at] + @ttl > Time.now.to_i
+          held[:value]
         end
     end
   end

data/lib/masks/client/session.rb

@@ -60,7 +60,8 @@ module Masks
           url: "#{issuer.endpoint('authorization_endpoint')}?#{URI.encode_www_form(pairs)}",
           state: state,
           nonce: nonce,
-          verifier: pkce.verifier
+          verifier: pkce.verifier,
+          max_age: max_age&.to_i
         }
       end
 
@@ -215,10 +216,14 @@ module Masks
         HTTP.parse(Transport.new(url, tokens: tokens, key: dpop).request("GET", url, limit: HTTP::READ_LIMIT))
       end
 
-      def identity(tokens)
+      # The person the +tokens+ belong to: the ID token's claims merged over
+      # userinfo. With +max_age+, the seconds the app asked for when it started
+      # the sign-in, an ID token whose +auth_time+ is missing or older than
+      # that, plus 30 seconds of leeway, raises InvalidToken.
+      def identity(tokens, max_age: nil)
         return nil if tokens.id_token.nil?
 
-        claims = Verifier.new(issuer, audience: client_id).verify(tokens.id_token)
+        claims = Verifier.recent!(Verifier.new(issuer, audience: client_id).verify(tokens.id_token), max_age)
 
         profile(tokens).merge(claims)
       end

data/lib/masks/client/verifier.rb

@@ -5,6 +5,18 @@ module Masks
       ACCESS_TOKEN = "at+jwt".freeze
       LOGOUT_TOKEN = "logout+jwt".freeze
       ID_TOKEN = [ "jwt", nil ].freeze
+      AUTH_TIME_LEEWAY = 30
+
+      def self.recent!(claims, max_age)
+        return claims if max_age.nil?
+
+        signed_in_at = claims["auth_time"]
+        allowed = signed_in_at.is_a?(Numeric) && signed_in_at + max_age.to_i + AUTH_TIME_LEEWAY >= Time.now.to_i
+
+        raise InvalidToken, "the person signed in longer ago than max_age allows" unless allowed
+
+        claims
+      end
 
       attr_reader :issuer, :audience
 
@@ -51,10 +63,7 @@ module Masks
         end
 
         def keys
-          ->(options) do
-            issuer.refresh! if options[:invalidate]
-            issuer.jwks
-          end
+          ->(options) { options[:invalidate] ? issuer.keys! : issuer.jwks }
         end
     end
   end

data/lib/masks/rails/authentication.rb

@@ -194,12 +194,15 @@ module Masks
         held.merge(profile.slice(*IDENTITY))
       end
 
-      def masks_login_url(return_to: nil, organization: nil, privilege: nil)
+      # Where to send someone to sign in. +max_age+ asks masks for a sign-in no
+      # older than that many seconds; an older one is refused at the callback.
+      def masks_login_url(return_to: nil, organization: nil, privilege: nil, max_age: nil)
         path = Masks::Rails::Engine.routes.url_helpers.start_path
         query = {
           "return_to" => masks_local_path(return_to),
           "organization" => Masks::Client::Session.organization_key(organization),
-          "privilege" => Array(privilege).join(" ").presence
+          "privilege" => Array(privilege).join(" ").presence,
+          "max_age" => (max_age.to_i if max_age.to_i.positive?)
         }.compact
 
         query.empty? ? path : "#{path}?#{URI.encode_www_form(query)}"

data/lib/masks/version.rb

@@ -1,3 +1,3 @@
 module Masks
-  VERSION = "0.12.0".freeze
+  VERSION = "0.12.2".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: masks
 version: !ruby/object:Gem::Version
-  version: 0.12.0
+  version: 0.12.2
 platform: ruby
 authors:
 - the masks authors
@@ -42,6 +42,7 @@ files:
 - app/views/layouts/masks/rails/plain.html.erb
 - app/views/masks/rails/handshakes/refused.html.erb
 - app/views/masks/rails/handshakes/show.html.erb
+- app/views/masks/rails/sessions/confirm.html.erb
 - config/routes.rb
 - lib/generators/masks/install/install_generator.rb
 - lib/generators/masks/install/templates/masks.rb.tt