masks 0.12.1 → 0.13.0

data/lib/masks/rails/authentication.rb

@@ -11,7 +11,7 @@ module Masks
         end
 
         if respond_to?(:rescue_from) && method_defined?(:render)
-          rescue_from Masks::Rails::Cache::Unavailable, with: :masks_cache_unavailable
+          rescue_from Masks::Client::Unavailable, with: :masks_cache_unavailable
         end
       end
 
@@ -84,10 +84,10 @@ module Masks
         Masks::Client::Claims::ORGANIZATIONS
       ].freeze
 
-      def masks_identity_from(tokens)
+      def masks_identity_from(tokens, nonce: nil, max_age: nil)
         return nil if tokens.id_token.nil?
 
-        masks_session.identity(tokens)
+        masks_session.identity(tokens, nonce: nonce, max_age: max_age)
       end
 
       def masks_forget
@@ -163,7 +163,7 @@ module Masks
 
         renewal = begin
           masks_cache.renew(masks_config.issuer_for(request).to_s, spent) { masks_renewal(spent) }
-        rescue Masks::Rails::Cache::Unavailable
+        rescue Masks::Client::Unavailable
           Masks::Rails::Renewal.unreachable
         end
 
@@ -194,12 +194,15 @@ module Masks
         held.merge(profile.slice(*IDENTITY))
       end
 
-      def masks_login_url(return_to: nil, organization: nil, privilege: nil)
+      # Where to send someone to sign in. +max_age+ asks masks for a sign-in no
+      # older than that many seconds; an older one is refused at the callback.
+      def masks_login_url(return_to: nil, organization: nil, privilege: nil, max_age: nil)
         path = Masks::Rails::Engine.routes.url_helpers.start_path
         query = {
           "return_to" => masks_local_path(return_to),
           "organization" => Masks::Client::Session.organization_key(organization),
-          "privilege" => Array(privilege).join(" ").presence
+          "privilege" => Array(privilege).join(" ").presence,
+          "max_age" => (max_age.to_i if max_age.to_i.positive?)
         }.compact
 
         query.empty? ? path : "#{path}?#{URI.encode_www_form(query)}"
@@ -237,7 +240,7 @@ module Masks
           Masks::Rails::Renewal.renewed(refreshed, masks_refreshed_identity(refreshed))
         rescue Masks::Client::Unregistered
           Masks::Rails::Renewal.unregistered
-        rescue Masks::Client::Rejected => e
+        rescue Masks::Client::Refused => e
           e.status.to_i >= 500 || e.status.to_i == 429 ? Masks::Rails::Renewal.unreachable : Masks::Rails::Renewal.refused
         rescue Masks::Client::Error
           Masks::Rails::Renewal.unreachable
@@ -271,7 +274,7 @@ module Masks
 
           if masks_asked_already?(session.delete(STEPPED_UP), missing)
             raise Masks::Client::Forbidden.new(
-              "insufficient_scope", "this account does not hold the #{missing.join(' and ')} privilege",
+              *Masks::Client.failure("no_privilege", missing.join(" and ")),
               scope: missing.flat_map { |name| masks_config.privilege(name).scopes }.join(" ")
             )
           end
@@ -326,7 +329,7 @@ module Masks
           response.headers["Retry-After"] = "5"
 
           if masks_wants_json?
-            render json: { "error" => "temporarily_unavailable", "error_description" => error.message },
+            render json: { "error" => "temporarily_unavailable", "error_description" => error.description },
                    status: :service_unavailable
           else
             render plain: "Signing in is unavailable right now. Try again in a moment.", status: :service_unavailable

data/lib/masks/rails/cache.rb

@@ -1,8 +1,6 @@
 module Masks
   module Rails
     class Cache
-      class Unavailable < Masks::Client::Error; end
-
       CLAIM = 30
       RESULT = 60
       WAIT = 0.05
@@ -41,7 +39,7 @@ module Masks
 
         kept = begin
           write(self.class.key("departed", issuer, kind, value), self.class.now, expires_in: DEPARTURE)
-        rescue Unavailable
+        rescue Masks::Client::Unavailable
           false
         end
 
@@ -49,7 +47,7 @@ module Masks
 
         forgotten { delete(self.class.key("logout", issuer, logout.jti)) }
 
-        raise Unavailable, "the cache did not keep that logout"
+        raise Masks::Client::Unavailable, "the cache did not keep that logout"
       end
 
       def departed?(issuer, identity, since:)
@@ -87,7 +85,7 @@ module Masks
           return true if write(key, 1, unless_exist: true, expires_in: expires_in)
           return false unless read(key).nil?
 
-          raise Unavailable, "the cache neither kept that key nor holds it, so it is not answering"
+          raise Masks::Client::Unavailable, "the cache neither kept that key nor holds it, so it is not answering"
         end
 
         def read(key)
@@ -104,15 +102,15 @@ module Masks
 
         def reached
           yield
-        rescue Unavailable
+        rescue Masks::Client::Unavailable
           raise
         rescue StandardError => e
-          raise Unavailable, "the cache could not be reached (#{e.class})"
+          raise Masks::Client::Unavailable, Masks::Client.saying("store_unreachable")
         end
 
         def forgotten
           yield
-        rescue Unavailable
+        rescue Masks::Client::Unavailable
           nil
         end
 

data/lib/masks/rails/configuration.rb

@@ -1,7 +1,11 @@
 module Masks
   module Rails
     class Configuration
-      class Unconfigured < Masks::Client::Error; end
+      class Unconfigured < Masks::Client::Error
+        def initialize(description)
+          super("not_configured", description)
+        end
+      end
 
       Privilege = Struct.new(:name, :scopes, :roles, :organization, keyword_init: true)
       PRIVILEGE_KEYS = %w[scope role organization].freeze

data/lib/masks/rails/protected_resource.rb

@@ -6,7 +6,7 @@ module Masks
       include Masks::Rails::Privileged
 
       included do
-        rescue_from Masks::Client::ReplayUnavailable, with: :masks_unavailable if respond_to?(:rescue_from)
+        rescue_from Masks::Client::Unavailable, with: :masks_unavailable if respond_to?(:rescue_from)
       end
 
       def masks_resource
@@ -25,7 +25,9 @@ module Masks
       def masks_authenticate(scope: nil, role: nil, organization: nil)
         masks_resource.authenticate(request.authorization, scope: scope, role: role, organization: organization,
                                                            **masks_proof)
-      rescue Masks::Client::Unauthenticated
+      rescue Masks::Client::InvalidToken => e
+        raise unless e.missing?
+
         nil
       end
 
@@ -34,15 +36,15 @@ module Masks
       end
 
       def masks_challenge(error)
-        error = Masks::Client::Unauthorized.new(error.to_s) unless error.is_a?(Masks::Client::Challenge)
+        error = Masks::Client::InvalidToken.new(error.to_s) unless error.is_a?(Masks::Client::Error)
 
         response.headers["WWW-Authenticate"] = masks_resource.challenge(error)
         response.headers["Cache-Control"] = "no-store"
 
         render json: {
-          "error" => error.code || "invalid_token",
+          "error" => error.code,
           "error_description" => error.description
-        }, status: error.status
+        }, status: error.status || 401
       end
 
       def masks_unavailable
@@ -72,7 +74,7 @@ module Masks
 
           @masks_token_claims = claims
           true
-        rescue Masks::Client::Challenge => e
+        rescue Masks::Client::InvalidToken, Masks::Client::Forbidden => e
           masks_challenge(e)
           false
         end

data/lib/masks/version.rb

@@ -1,3 +1,3 @@
 module Masks
-  VERSION = "0.12.1".freeze
+  VERSION = "0.13.0".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: masks
 version: !ruby/object:Gem::Version
-  version: 0.12.1
+  version: 0.13.0
 platform: ruby
 authors:
 - the masks authors
@@ -55,8 +55,10 @@ files:
 - lib/masks/client/embedded.rb
 - lib/masks/client/enrollment.rb
 - lib/masks/client/errors.rb
+- lib/masks/client/failures.rb
 - lib/masks/client/handshake.rb
 - lib/masks/client/http.rb
+- lib/masks/client/id_token.rb
 - lib/masks/client/introspection.rb
 - lib/masks/client/issuer.rb
 - lib/masks/client/key.rb