masks 0.12.1 → 0.12.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 421d8bafc01e79df7edd7738c30d85a09919fe62dae16944a0d53278fd93f616
-  data.tar.gz: 9671445e035576d9c89b3d4cdffa28b7a6448b29c23201ad791085c3d30cfa2e
+  metadata.gz: 638e4da3d119c8e1841e1d8f4d87742133ac14ef28c8b1f7dbbdd55725913974
+  data.tar.gz: 5c704c90104b9fa581948029a2897e40e1e69f66573739f33aa6c3b7ceae14d4
 SHA512:
-  metadata.gz: 521d775b39d102648c40f513ccb0d23299ee0af608d882a3eba878d2c8d4d0bd1713fd2a245d74bf725416c62b6e85e9fc596ce11343e29708068d4d31ff1817
-  data.tar.gz: 535c2e15b8ea0c574a8fca4109e2e6133c0f52991d4764be81ef3a20421142fafe8bb58a6e9d49e3ecc672c168b680e90b7cc73b4412233cab183fffacf65089
+  metadata.gz: 97f6edc170dc1544af96fa847f7513a547a39422fffa2435c44f8073bcfaaaf205bf60ed4fc1f1bf82b50c968e9b21e7ff88558fc2042039df5be4ab332b8174
+  data.tar.gz: f0c0b5d58b797556ef18dffdf3a81b09e9f94407c68da642950c4578639376a109064b3efbb24d5c802edef0c138a2f079002229f35d9ae520bc2c98ff0c5439

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [0.12.2](https://github.com/masksrb/masks/compare/gem/v0.12.1...gem/v0.12.2) (2026-10-20)
+
+
+### Fixes
+
+* **client:** a sign-in older than the max_age the app asked for is refused ([7116e24](https://github.com/masksrb/masks/commit/7116e24e73dedcca6ce54aa4347100b7d4714e3a)), closes [#161](https://github.com/masksrb/masks/issues/161)
+* **client:** the last good issuer and keys are served while masks is down ([1423d1e](https://github.com/masksrb/masks/commit/1423d1ea6b7968aa66ad2a2ca63180effa4c1002)), closes [#162](https://github.com/masksrb/masks/issues/162)
+
 ## [0.12.1](https://github.com/masksrb/masks/compare/gem/v0.12.0...gem/v0.12.1) (2026-10-19)
 
 

data/app/controllers/masks/rails/sessions_controller.rb

@@ -35,12 +35,13 @@ module Masks
           state: pending.id,
           resource: masks_config.resource_for(request),
           scope: masks_config.scope_for(params[:privilege]),
+          max_age: (params[:max_age].to_i if params[:max_age].to_i.positive?),
           organization: Masks::Client::Session.organization_key(params[:organization]) ||
             masks_config.organization_for(request)
         )
 
         masks_requests.amend(
-          pending.id, nonce: started[:nonce], verifier: started[:verifier]
+          pending.id, nonce: started[:nonce], verifier: started[:verifier], max_age: started[:max_age]
         )
 
         redirect_to started[:url], allow_other_host: true
@@ -69,6 +70,10 @@ module Masks
           return refuse("invalid_nonce", "the id token was issued for another request", pending)
         end
 
+        unless recent?(identity, pending[:max_age])
+          return refuse("invalid_token", "the person signed in longer ago than max_age allows", pending)
+        end
+
         renew_session
         masks_store(tokens, identity: identity)
 
@@ -156,6 +161,13 @@ module Masks
           masks_local_path(params[:return_to])
         end
 
+        def recent?(identity, max_age)
+          Masks::Client::Verifier.recent!(identity.is_a?(Hash) ? identity : {}, max_age)
+          true
+        rescue Masks::Client::InvalidToken
+          false
+        end
+
         def nonce_matches?(identity, sent)
           return false if identity == :unverified
           return true if sent.blank?

data/lib/masks/client/issuer.rb

@@ -1,8 +1,15 @@
 module Masks
   module Client
+    # One issuer's discovery document and keys, fetched once and kept for an
+    # hour. While masks cannot be reached, the last good copies are served, a
+    # token signed with a key never seen raises Unreachable, and refetches back
+    # off from 5 seconds to once a minute.
     class Issuer
       DISCOVERY_PATH = "/.well-known/openid-configuration".freeze
-      TTL = 300
+      LIFETIME = 3600
+      FIRST_BACKOFF = 5
+      LONGEST_BACKOFF = 60
+      TTL = LIFETIME
 
       def self.normalize(url)
         url.to_s.chomp("/")
@@ -44,6 +51,10 @@ module Masks
         fetch(:jwks) { HTTP.get(endpoint("jwks_uri")) }
       end
 
+      def keys!
+        fetch(:jwks, now: true) { HTTP.get(endpoint("jwks_uri")) }
+      end
+
       def tenant
         discovery["tenant"]
       end
@@ -73,24 +84,41 @@ module Masks
       end
 
       def refresh!
-        @lock.synchronize { @cache = {} }
+        @lock.synchronize { @cache.each_value { |held| held[:at] = 0 } }
         self
       end
 
       private
 
-        def fetch(key)
-          cached = @lock.synchronize { @cache[key] }
-          return cached[:value] if fresh?(cached)
+        def fetch(key, now: false, &fetching)
+          held = @lock.synchronize { @cache[key] ||= { backoff: FIRST_BACKOFF, retry_at: 0 } }
+          clock = Time.now.to_i
+          good = held.key?(:value)
+
+          return held[:value] if good && !now && (held[:at] + @ttl > clock || clock < held[:retry_at])
+          raise held[:failure] if clock < held[:retry_at]
+
+          refetch(held, clock, keep: good && !now, &fetching)
+        end
 
+        def refetch(held, clock, keep:)
           value = yield
 
-          @lock.synchronize { @cache[key] = { value: value, at: Time.now.to_i } }
+          @lock.synchronize do
+            held.merge!(value: value, at: clock, failure: nil, retry_at: 0, backoff: FIRST_BACKOFF)
+          end
+
           value
-        end
+        rescue Masks::Client::Error => e
+          @lock.synchronize do
+            held[:failure] = e
+            held[:retry_at] = clock + held[:backoff]
+            held[:backoff] = [ held[:backoff] * 2, LONGEST_BACKOFF ].min
+          end
+
+          raise e unless keep
 
-        def fresh?(entry)
-          entry && entry[:at] + @ttl > Time.now.to_i
+          held[:value]
         end
     end
   end

data/lib/masks/client/session.rb

@@ -60,7 +60,8 @@ module Masks
           url: "#{issuer.endpoint('authorization_endpoint')}?#{URI.encode_www_form(pairs)}",
           state: state,
           nonce: nonce,
-          verifier: pkce.verifier
+          verifier: pkce.verifier,
+          max_age: max_age&.to_i
         }
       end
 
@@ -215,10 +216,14 @@ module Masks
         HTTP.parse(Transport.new(url, tokens: tokens, key: dpop).request("GET", url, limit: HTTP::READ_LIMIT))
       end
 
-      def identity(tokens)
+      # The person the +tokens+ belong to: the ID token's claims merged over
+      # userinfo. With +max_age+, the seconds the app asked for when it started
+      # the sign-in, an ID token whose +auth_time+ is missing or older than
+      # that, plus 30 seconds of leeway, raises InvalidToken.
+      def identity(tokens, max_age: nil)
         return nil if tokens.id_token.nil?
 
-        claims = Verifier.new(issuer, audience: client_id).verify(tokens.id_token)
+        claims = Verifier.recent!(Verifier.new(issuer, audience: client_id).verify(tokens.id_token), max_age)
 
         profile(tokens).merge(claims)
       end

data/lib/masks/client/verifier.rb

@@ -5,6 +5,18 @@ module Masks
       ACCESS_TOKEN = "at+jwt".freeze
       LOGOUT_TOKEN = "logout+jwt".freeze
       ID_TOKEN = [ "jwt", nil ].freeze
+      AUTH_TIME_LEEWAY = 30
+
+      def self.recent!(claims, max_age)
+        return claims if max_age.nil?
+
+        signed_in_at = claims["auth_time"]
+        allowed = signed_in_at.is_a?(Numeric) && signed_in_at + max_age.to_i + AUTH_TIME_LEEWAY >= Time.now.to_i
+
+        raise InvalidToken, "the person signed in longer ago than max_age allows" unless allowed
+
+        claims
+      end
 
       attr_reader :issuer, :audience
 
@@ -51,10 +63,7 @@ module Masks
         end
 
         def keys
-          ->(options) do
-            issuer.refresh! if options[:invalidate]
-            issuer.jwks
-          end
+          ->(options) { options[:invalidate] ? issuer.keys! : issuer.jwks }
         end
     end
   end

data/lib/masks/rails/authentication.rb

@@ -194,12 +194,15 @@ module Masks
         held.merge(profile.slice(*IDENTITY))
       end
 
-      def masks_login_url(return_to: nil, organization: nil, privilege: nil)
+      # Where to send someone to sign in. +max_age+ asks masks for a sign-in no
+      # older than that many seconds; an older one is refused at the callback.
+      def masks_login_url(return_to: nil, organization: nil, privilege: nil, max_age: nil)
         path = Masks::Rails::Engine.routes.url_helpers.start_path
         query = {
           "return_to" => masks_local_path(return_to),
           "organization" => Masks::Client::Session.organization_key(organization),
-          "privilege" => Array(privilege).join(" ").presence
+          "privilege" => Array(privilege).join(" ").presence,
+          "max_age" => (max_age.to_i if max_age.to_i.positive?)
         }.compact
 
         query.empty? ? path : "#{path}?#{URI.encode_www_form(query)}"

data/lib/masks/version.rb

@@ -1,3 +1,3 @@
 module Masks
-  VERSION = "0.12.1".freeze
+  VERSION = "0.12.2".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: masks
 version: !ruby/object:Gem::Version
-  version: 0.12.1
+  version: 0.12.2
 platform: ruby
 authors:
 - the masks authors