masks 0.4.0 → 0.5.0

data/app/models/masks/openid/authorization.rb

@@ -1,116 +0,0 @@
-# frozen_string_literal: true
-module Masks
-  module OpenID
-    # Manages authorizations for OpenID/OAuth2 requests.
-    class Authorization
-      attr_accessor :client, :scopes, :response, :response_type
-
-      class << self
-        def perform(env, **opts)
-          authorization = new(env, **opts)
-          authorization.perform
-          authorization
-        end
-      end
-
-      def initialize(env, **opts)
-        @env = env
-        @app =
-          Rack::OAuth2::Server::Authorize.new do |req, res|
-            @client =
-              session.config.model(:openid_client).find_by(key: req.client_id)
-
-            req.bad_request!(:client_id, "not found") unless @client
-
-            unless req.redirect_uri
-              req.invalid_request!('"redirect_uri" missing')
-            end
-
-            unless @client.redirect_uris.any?
-              @client.redirect_uris = [req.redirect_uri.to_s]
-              @client.valid? || req.invalid_request!('"redirect_uri" invalid')
-            end
-
-            res.redirect_uri = req.verify_redirect_uri!(@client.redirect_uris)
-
-            @scopes = req.scope & @client.scopes
-
-            if res.protocol_params_location == :fragment && req.nonce.blank?
-              req.invalid_request! "nonce required"
-            end
-
-            if @client.response_types.include?(
-                 Array(req.response_type).collect(&:to_s).join(" ")
-               )
-              if actor
-                if opts[:approved] || client.auto_consent?
-                  @client.save if @client.redirect_uris_changed?
-
-                  approved! req, res
-                elsif opts.key?(:approved)
-                  req.access_denied!
-                end
-              end
-            else
-              req.unsupported_response_type!
-            end
-          end
-      end
-
-      def session
-        @session ||= @env[Masks::Middleware::SESSION_KEY]
-      end
-
-      def actor
-        @actor ||= (session.actor if session.passed?)
-      end
-
-      def perform
-        @response = @app.call(@env)
-      end
-
-      def approved!(req, res)
-        response_types = Array(req.response_type)
-
-        if response_types.include? :code
-          authorization =
-            actor.openid_authorizations.create!(
-              openid_client: client,
-              redirect_uri: res.redirect_uri,
-              nonce: req.nonce,
-              scopes: @scopes
-            )
-
-          res.code = authorization.code
-        end
-
-        if response_types.include? :token
-          access_token =
-            actor.openid_access_tokens.create!(
-              openid_client: client,
-              scopes: @scopes
-            )
-
-          res.access_token = access_token.to_bearer_token
-        end
-
-        if response_types.include? :id_token
-          id_token =
-            actor.openid_id_tokens.create!(
-              openid_client: @client,
-              nonce: req.nonce
-            )
-
-          res.id_token =
-            id_token.to_jwt(
-              code: (res.respond_to?(:code) ? res.code : nil),
-              access_token:
-                (res.respond_to?(:access_token) ? res.access_token : nil)
-            )
-        end
-
-        res.approve!
-      end
-    end
-  end
-end

data/app/models/masks/openid/token.rb

@@ -1,56 +0,0 @@
-# frozen_string_literal: true
-module Masks
-  module OpenID
-    # Implementation of the Token Endpoint in OIDC.
-    #
-    # Technically speaking, this conforms to the rack interface
-    # so it can be used directly for managing requests for access
-    # tokens.
-    class Token
-      attr_accessor :app
-
-      delegate :call, to: :app
-
-      def initialize
-        @app =
-          Rack::OAuth2::Server::Token.new do |req, res|
-            client =
-              Masks
-                .configuration
-                .model(:openid_client)
-                .find_by(key: req.client_id) || req.invalid_client!
-            client.secret == req.client_secret || req.invalid_client!
-            client.grant_types.include?(req.grant_type.to_s) ||
-              req.unsupported_grant_type!
-
-            case req.grant_type
-            when :client_credentials
-              res.access_token = client.access_tokens.create!.to_bearer_token
-            when :authorization_code
-              authorization =
-                client.authorizations.valid.where(code: req.code).first
-              unless authorization&.valid_redirect_uri?(req.redirect_uri)
-                req.invalid_grant!
-              end
-              access_token = authorization.access_token
-              res.access_token = access_token.to_bearer_token
-
-              if access_token.scope?("openid")
-                res.id_token =
-                  access_token
-                    .actor
-                    .openid_id_tokens
-                    .create!(
-                      openid_client: access_token.openid_client,
-                      nonce: authorization.nonce
-                    )
-                    .to_jwt
-              end
-            else
-              req.unsupported_grant_type!
-            end
-          end
-      end
-    end
-  end
-end

data/app/models/masks/rails/actor.rb

@@ -1,212 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  module Rails
-    class Actor < ApplicationRecord
-      include Masks::Actor
-
-      self.table_name = "actors"
-
-      scope :expired,
-            lambda {
-              where(
-                "last_login_at < ?",
-                Masks.configuration.lifetimes[:expired_actor]&.ago ||
-                  6.months.ago
-              )
-            }
-
-      has_many :saved_scopes,
-               class_name: Masks.configuration.models[:scope],
-               autosave: true
-      has_many :saved_roles,
-               class_name: Masks.configuration.models[:role],
-               autosave: true
-      has_many :recoveries,
-               class_name: Masks.configuration.models[:recovery],
-               autosave: true
-      has_many :emails, class_name: Masks.configuration.models[:email]
-      has_many :devices,
-               class_name: Masks.configuration.models[:device],
-               autosave: true
-      has_many :keys,
-               class_name: Masks.configuration.models[:key],
-               autosave: true
-      has_many :openid_authorizations,
-               class_name: Masks.configuration.models[:openid_authorization],
-               autosave: true
-      has_many :openid_access_tokens,
-               class_name: Masks.configuration.models[:openid_access_token],
-               autosave: true
-      has_many :openid_id_tokens,
-               class_name: Masks.configuration.models[:openid_id_token],
-               autosave: true
-
-      has_secure_password
-
-      attribute :signup
-      attribute :session
-      attribute :totp_code
-
-      before_validation :reset_version, unless: :version
-
-      validates :nickname, presence: true, uniqueness: { case_sensitive: false }
-      validates :totp_secret, presence: true, if: :totp_code
-      validates :version, presence: true
-      validate :validates_totp, if: :totp_code
-      validate :validates_password, if: :password
-      validate :validates_signup
-
-      before_save :regenerate_backup_codes
-
-      serialize :backup_codes, coder: JSON
-
-      def to_param
-        nickname
-      end
-
-      def primary_email
-        emails.where(verified: true).first
-      end
-
-      def email_addresses
-        emails.pluck(:email)
-      end
-
-      def factor2?
-        phone_number || totp_secret
-      end
-
-      def remove_factor2!
-        self.added_totp_secret_at = nil
-        saved_backup_codes_at
-        self.totp_secret = nil
-        self.backup_codes = nil
-        save!
-      end
-
-      def logout!
-        reset_version
-        save!
-      end
-
-      def totp_uri
-        (totp || random_totp).provisioning_uri(nickname)
-      end
-
-      def totp_svg(**opts)
-        qrcode = RQRCode::QRCode.new(totp_uri)
-        qrcode.as_svg(**opts)
-      end
-
-      def totp
-        return unless totp_secret
-
-        ROTP::TOTP.new(totp_secret, issuer: Masks.configuration.issuer)
-      end
-
-      def random_totp
-        ROTP::TOTP.new(random_totp_secret, issuer: Masks.configuration.issuer)
-      end
-
-      def random_totp_secret
-        @random_totp_secret ||= ROTP::Base32.random
-      end
-
-      def assign_scopes(*list)
-        list.map { |scope| saved_scopes.find_or_initialize_by(name: scope) }
-      end
-
-      def assign_scopes!(*list)
-        list.map { |scope| saved_scopes.find_or_create_by(name: scope) }
-      end
-
-      def remove_scopes!(*list)
-        saved_scopes.where(name: list).destroy_all
-      end
-
-      def assign_role(record, **opts)
-        saved_roles
-          .find_by!(record:)
-          .tap { |role| role.assign_attributes(**opts) }
-      rescue ActiveRecord::RecordNotFound
-        saved_roles.build(record:, **opts)
-      end
-
-      def assign_role!(record, **opts)
-        assign_role(record, **opts).save!
-      end
-
-      def remove_role!(record)
-        saved_roles.where(record:).destroy_all
-      end
-
-      def scopes
-        @scopes ||= saved_scopes.order(created_at: :desc).pluck(:name)
-      end
-
-      def roles(record, **opts)
-        case record
-        when Class, String
-          saved_roles.where(record_type: record.to_s, **opts).includes(:record)
-        else
-          saved_roles.where(record:, **opts)
-        end
-      end
-
-      def mask!
-        save # sub-classes are encouraged to override
-      end
-
-      def should_save_backup_codes?
-        factor2? && saved_backup_codes_at.blank?
-      end
-
-      def saved_backup_codes?
-        factor2? && saved_backup_codes_at.present?
-      end
-
-      def changed_during_mask?
-        changed? && changes.keys != ["session"]
-      end
-
-      private
-
-      def validates_totp
-        errors.add(:totp_code, :invalid) unless totp.verify(totp_code)
-      end
-
-      def validates_password
-        opts = Masks.configuration.dat.password&.length&.to_h
-
-        return unless password && opts
-
-        if opts[:min] && password.length < opts[:min]
-          errors.add(:password, :too_short, count: opts[:min])
-        elsif opts[:max] && password.length > opts[:max]
-          errors.add(key, :too_long, count: opts[:max])
-        end
-      end
-
-      def validates_signup
-        return unless !persisted? && !Masks.configuration.signups? && signup
-
-        errors.add(:signup, :disabled)
-      end
-
-      def reset_version
-        self.version = SecureRandom.hex
-      end
-
-      def regenerate_backup_codes
-        if factor2?
-          self.backup_codes ||=
-            (1..12).to_h { |_i| [SecureRandom.base58(10), true] }
-        else
-          self.backup_codes = nil
-          self.saved_backup_codes_at = nil
-        end
-      end
-    end
-  end
-end

data/app/models/masks/rails/actor_role.rb

@@ -1,12 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  module Rails
-    class ActorRole < ApplicationRecord
-      self.table_name = "actor_roles"
-
-      belongs_to :actor, class_name: Masks.configuration.models[:actor]
-      belongs_to :role, class_name: Masks.configuration.models[:role]
-    end
-  end
-end

data/app/models/masks/rails/device.rb

@@ -1,47 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  module Rails
-    class Device < ApplicationRecord
-      self.table_name = "devices"
-
-      attribute :session
-
-      belongs_to :actor, class_name: Masks.configuration.models[:actor]
-
-      validates :key, presence: true, uniqueness: { scope: :actor_id }
-      validates :known?, presence: true
-
-      after_initialize :reset_version, unless: :version
-      before_validation :copy_session, if: :session
-
-      def known?
-        session.device&.known?
-      end
-
-      def session_key
-        Digest::SHA512.hexdigest([key, version].join("-"))
-      end
-
-      def reset_version
-        self.version = SecureRandom.hex
-      end
-
-      delegate :name, :device_type, :device_name, :os_name, to: :detected
-
-      private
-
-      def detected
-        @detected ||= DeviceDetector.new(user_agent || session&.user_agent)
-      end
-
-      def copy_session
-        return unless known?
-
-        self.user_agent ||= session.user_agent
-        self.ip_address ||= session.ip_address
-        self.fingerprint ||= session.fingerprint
-      end
-    end
-  end
-end

data/app/models/masks/rails/email.rb

@@ -1,96 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  module Rails
-    class Email < ApplicationRecord
-      self.table_name = "emails"
-
-      belongs_to :actor, class_name: Masks.configuration.models[:actor]
-
-      validates :token, presence: true, uniqueness: true
-      validates :email, presence: true, email: true
-      validates :expired?, absence: true
-
-      validate :validates_verified_email
-
-      after_initialize :generate_token
-      before_validation :downcase_email
-
-      def notify!(session)
-        return if verified?
-
-        if expired? && !verified?
-          self.notified_at = nil
-          self.token = nil
-
-          generate_token
-        end
-
-        return if notified?
-
-        self.notified_at = Time.current
-
-        return unless valid?
-
-        save
-        ActorMailer.with(session:, email: self).verify_email.deliver_now
-      end
-
-      def verify!
-        return if verified?
-
-        self.verified_at = Time.current
-        self.verified = true
-        save!
-      end
-
-      def to_param
-        token
-      end
-
-      def notified?
-        notified_at.present?
-      end
-
-      def expired?
-        return false unless notified?
-
-        notified_at <=
-          (Masks.configuration.lifetimes[:verification_email] || 1.hour).ago
-      end
-
-      def taken?
-        self.class.where(email:, verified: true).any?
-      end
-
-      private
-
-      def validates_verified_email
-        # not sure how to check this with uniqueness conditions,
-        # so using a custom validation
-        query =
-          self.class.where(
-            [
-              persisted? ? "id != :id AND (" : "(",
-              "(email = :email AND verified) OR",
-              "(actor_id = :actor_id AND email = :email)",
-              ")"
-            ].compact.join(" "),
-            actor_id: actor.id,
-            email: email.downcase,
-            id:
-          )
-
-        errors.add(:email, :taken) if query.any?
-      end
-
-      def generate_token
-        self.token ||= SecureRandom.hex
-      end
-
-      def downcase_email
-        self.email = email&.downcase
-      end
-    end
-  end
-end

data/app/models/masks/rails/key.rb

@@ -1,61 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  module Rails
-    class Key < ApplicationRecord
-      include Masks::Scoped
-
-      self.table_name = "keys"
-
-      class << self
-        def sha(secret)
-          Digest::SHA512.hexdigest(secret)
-        end
-      end
-
-      scope :latest, -> { order(created_at: :desc) }
-
-      attribute :session
-      attribute :secret
-
-      serialize :scopes, coder: JSON
-
-      belongs_to :actor, class_name: Masks.configuration.models[:actor]
-
-      after_initialize :generate_hash
-
-      validates :name, presence: true, length: { maximum: 32 }
-      validates :sha, presence: true, uniqueness: true
-
-      def nickname
-        [name.parameterize, sha.slice(0...32)].join("-")
-      end
-
-      alias slug nickname
-
-      def scopes
-        value = self[:scopes]
-
-        return [] unless value
-
-        value & (actor&.scopes || [])
-      end
-
-      def roles_for(_record, **_opts)
-        []
-      end
-
-      private
-
-      def generate_secret
-        self.secret ||= SecureRandom.uuid
-      end
-
-      def generate_hash
-        self.secret ||= SecureRandom.uuid
-
-        self.sha = self.class.sha(secret) if self.secret
-      end
-    end
-  end
-end

data/app/models/masks/rails/openid/access_token.rb

@@ -1,55 +0,0 @@
-# frozen_string_literal: true
-module Masks
-  module Rails
-    module OpenID
-      class AccessToken < ApplicationRecord
-        include Masks::Scoped
-
-        self.table_name = "openid_access_tokens"
-
-        scope :valid, -> { where("expires_at >= ?", Time.now.utc) }
-
-        belongs_to :actor,
-                   class_name: Masks.configuration.models[:actor],
-                   optional: true
-        belongs_to :openid_client,
-                   class_name: Masks.configuration.models[:openid_client]
-
-        serialize :scopes, coder: JSON
-
-        before_validation :generate_token
-
-        validates :openid_client, presence: true
-        validates :token, presence: true, uniqueness: true
-        validates :expires_at, presence: true
-
-        def scopes
-          value = self[:scopes]
-
-          return [] unless value
-
-          value & ((actor&.scopes || []) + openid_client.scopes)
-        end
-
-        def roles(*args, **opts)
-          (actor || openid_client).roles(*args, **opts)
-        end
-
-        def to_bearer_token
-          Rack::OAuth2::AccessToken::Bearer.new(
-            access_token: token,
-            expires_in: (expires_at - Time.now.utc).to_i
-          )
-        end
-
-        private
-
-        def generate_token
-          self.token ||= SecureRandom.uuid
-          self.expires_at ||= openid_client.token_expires_at
-          self.scopes ||= []
-        end
-      end
-    end
-  end
-end

data/app/models/masks/rails/openid/authorization.rb

@@ -1,45 +0,0 @@
-# frozen_string_literal: true
-module Masks
-  module Rails
-    module OpenID
-      class Authorization < ApplicationRecord
-        self.table_name = "openid_authorizations"
-
-        scope :valid, -> { where("expires_at >= ?", Time.now.utc) }
-
-        belongs_to :actor, class_name: Masks.configuration.models[:actor]
-        belongs_to :openid_client,
-                   class_name: Masks.configuration.models[:openid_client]
-
-        serialize :scopes, coder: JSON
-
-        before_validation :generate_code
-
-        validates :actor, presence: true
-        validates :openid_client, presence: true
-        validates :code, presence: true, uniqueness: true
-        validates :expires_at, presence: true
-
-        def valid_redirect_uri?(uri)
-          uri == redirect_uri
-        end
-
-        def access_token
-          @access_token ||=
-            update_attribute!(:expires_at, Time.now) && generate_access_token!
-        end
-
-        def generate_access_token!
-          actor.openid_access_tokens.create!(openid_client:, scopes:)
-        end
-
-        private
-
-        def generate_code
-          self.code ||= SecureRandom.uuid
-          self.expires_at ||= openid_client.code_expires_at
-        end
-      end
-    end
-  end
-end