masks 0.4.0 → 0.5.0

data/lib/masks.rb

@@ -1,184 +1,4 @@
-# frozen_string_literal: true
+require_relative "masks/version"
+require_relative "masks/client"
 
-require "masks/version"
-require "masks/engine"
-require "masks/configuration"
-require "fuzzyurl"
-require "valid_email"
-require "phonelib"
-require "rqrcode"
-require "rotp"
-require "alba"
-require "pagy"
-require "device_detector"
-require "active_model"
-require "chronic_duration"
-
-# Top-level module for masks.
-#
-# Includes helper methods for managing configuration and building
-# sessions, access, etc.
-module Masks
-  # @visibility private
-  ANON = :anon
-
-  class << self
-    # Returns an access instance based on the type & session passed.
-    #
-    # @param [Symbol|String] name
-    # @param [Masks::Session] session
-    # @return [Masks::Access]
-    # @raise [Masks::Error::Unauthorized] if access cannot be granted to the session passed
-    # @raise [Masks::UnknownAccess] if the access type cannot be found
-    def access(name, session, **_opts)
-      configuration.access(name).fetch(:cls).build(session)
-    end
-
-    # Returns a masked session based on the request passed.
-    #
-    # @param [ActionDispatch::Request] request
-    # @return [Masks::Sessions::Request] session
-    def request(request)
-      model = configuration.model(:request)
-      session = model.new(config: configuration, request:)
-      session.mask!
-      session
-    end
-
-    # Returns a masked session based on the params and data passed.
-    #
-    # This method is useful for creating masks directly, outside of a
-    # specific context like a web request.
-    #
-    # @param params [Hash]
-    # @param data [Hash]
-    # @yield [Masks::Sessions::Inline]
-    # @return [Masks::Sessions::Inline] session
-    def mask(name, params: {}, **data)
-      model = configuration.model(:inline)
-      session = model.new(name:, config: configuration, params:, data:)
-      session.mask!
-      yield session if session.passed? && block_given?
-      session
-    end
-
-    # Yields the global masks configuration object.
-    # @return [Masks::Configuration]
-    # @yield [Masks::Configuration]
-    def configure
-      yield configuration
-    end
-
-    # Returns the global configuration object for masks.
-    # @return [Masks::Configuration]
-    def configuration
-      @configuration ||= Masks::Configuration.new(data: config.dup)
-    end
-
-    # @visibility private
-    def event(name, **opts, &block)
-      ActiveSupport::Notifications.instrument("masks.#{name}", **opts) do
-        block.call
-      end
-    end
-
-    # @visibility private
-    def config
-      @config ||=
-        begin
-          config = load_config(config_path)
-
-          defaults =
-            if config[:extend]
-              # extend a "masks.json" from a gem
-              load_config(gem_path(config[:extend]))
-            else
-              {}
-            end
-
-          config = defaults.except(:masks).deep_merge(config)
-          config[:masks] = [*config[:masks], *defaults[:masks]] if defaults[
-            :masks
-          ]
-          config
-        end
-    end
-
-    # @visibility private
-    def with_config(path_or_config)
-      previous_config = @config
-      previous_path = @config_path
-
-      case path_or_config
-      when String
-        @config_path = Pathname.new(path_or_config)
-      when Pathname
-        @config_path = path_or_config
-      when Hash
-        @config_path = :custom
-        @config = path_or_config
-      else
-        raise Error::InvalidConfiguration, path_or_config
-      end
-
-      result = yield
-    ensure
-      @config = previous_config
-      @config_path = previous_path
-
-      result
-    end
-
-    # @visibility private
-    def config_path
-      path =
-        [
-          @config_path,
-          ENV["MASKS_DIR"] ? Pathname.new(ENV["MASKS_DIR"]) : nil,
-          Pathname.new(Dir.pwd),
-          defined?(ENGINE_ROOT) ? Pathname.new(ENGINE_ROOT) : nil
-        ].find do |p|
-          p.is_a?(Symbol) || (p && File.exist?(p.join("masks.json")))
-        end
-
-      raise Error::ConfigurationNotFound unless path
-
-      path
-    end
-
-    # @visibility private
-    def config_path=(value)
-      @config_path =
-        case value
-        when String
-          Pathname.new(value)
-        when Pathname
-          value
-        else
-          raise Error::InvalidConfiguration, value
-        end
-    end
-
-    # @visibility private
-    def reset!
-      @configuration = @config = @config_path = nil
-    end
-
-    def load_config(dir)
-      JSON.parse(File.read(dir.join("masks.json")), symbolize_names: true)
-    end
-
-    def gem_path(gem_name)
-      begin
-        # Try to require the gem
-        require gem_name
-      rescue LoadError
-        return nil
-      end
-
-      # Get the gem specification
-      spec = Gem::Specification.find_by_name(gem_name)
-      Pathname.new(spec.gem_dir) if spec
-    end
-  end
-end
+require_relative "masks/rails" if defined?(::Rails::Engine)

metadata

@@ -1,31 +1,16 @@
 --- !ruby/object:Gem::Specification
 name: masks
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
-- geiger-to
-autorequire: 
+- geiger
 bindir: bin
 cert_chain: []
-date: 2024-04-11 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: alba
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: bcrypt
+  name: jwt
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
@@ -38,427 +23,73 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '3.1'
-- !ruby/object:Gem::Dependency
-  name: chronic_duration
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.10'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.10'
-- !ruby/object:Gem::Dependency
-  name: cssbundling-rails
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.3'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.3'
-- !ruby/object:Gem::Dependency
-  name: device_detector
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: fuzzyurl
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.9.0
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.9.0
-- !ruby/object:Gem::Dependency
-  name: jsbundling-rails
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.2'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.2'
-- !ruby/object:Gem::Dependency
-  name: openid_connect
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.3'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.3'
-- !ruby/object:Gem::Dependency
-  name: pagy
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: phonelib
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: premailer-rails
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1'
-- !ruby/object:Gem::Dependency
-  name: rails
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 7.1.2
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 7.1.2
-- !ruby/object:Gem::Dependency
-  name: recursive-open-struct
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: rotp
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: rqrcode
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: sprockets-rails
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: stimulus-rails
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.3'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.3'
-- !ruby/object:Gem::Dependency
-  name: turbo-rails
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '1.5'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '3.0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '1.5'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '3.0'
-- !ruby/object:Gem::Dependency
-  name: valid_email
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.2'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.2'
-description: masks is a ruby library and rails engine that adds simple, extensible
-  auth to most applications. DO NOT USE
-email:
-- git@geiger.to
+description: Discovery, PKCE authorization, token exchange, and token verification
+  against a masks issuer, with Rack middleware for a resource server and a Rails engine
+  that mounts the consumer half of the code flow. The auth server itself stays standalone.
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- MIT-LICENSE
+- CHANGELOG.md
+- LICENSE
 - README.md
-- Rakefile
-- app/assets/builds/masks/application.css
-- app/assets/builds/masks/application.js
-- app/assets/builds/masks/application.js.map
-- app/assets/images/masks.png
-- app/assets/javascripts/application.js
-- app/assets/javascripts/controllers/application.js
-- app/assets/javascripts/controllers/emails_controller.js
-- app/assets/javascripts/controllers/index.js
-- app/assets/javascripts/controllers/keys_controller.js
-- app/assets/javascripts/controllers/recover_controller.js
-- app/assets/javascripts/controllers/recover_password_controller.js
-- app/assets/javascripts/controllers/session_controller.js
-- app/assets/javascripts/controllers/table_controller.js
-- app/assets/manifest.js
-- app/assets/masks_manifest.js
-- app/assets/stylesheets/application.css
-- app/controllers/concerns/masks/controller.rb
-- app/controllers/masks/actors_controller.rb
-- app/controllers/masks/application_controller.rb
-- app/controllers/masks/backup_codes_controller.rb
-- app/controllers/masks/debug_controller.rb
-- app/controllers/masks/devices_controller.rb
-- app/controllers/masks/emails_controller.rb
-- app/controllers/masks/error_controller.rb
-- app/controllers/masks/keys_controller.rb
-- app/controllers/masks/manage/actors_controller.rb
-- app/controllers/masks/manage/base_controller.rb
-- app/controllers/masks/manage/clients_controller.rb
-- app/controllers/masks/manage/dashboard_controller.rb
-- app/controllers/masks/manage/devices_controller.rb
-- app/controllers/masks/one_time_code_controller.rb
-- app/controllers/masks/openid/authorizations_controller.rb
-- app/controllers/masks/openid/discoveries_controller.rb
-- app/controllers/masks/openid/tokens_controller.rb
-- app/controllers/masks/openid/userinfo_controller.rb
-- app/controllers/masks/passwords_controller.rb
-- app/controllers/masks/recoveries_controller.rb
-- app/controllers/masks/sessions_controller.rb
-- app/helpers/masks/application_helper.rb
-- app/jobs/masks/application_job.rb
-- app/jobs/masks/expire_actors_job.rb
-- app/jobs/masks/expire_recoveries_job.rb
-- app/mailers/masks/actor_mailer.rb
-- app/mailers/masks/application_mailer.rb
-- app/models/concerns/masks/access.rb
-- app/models/concerns/masks/actor.rb
-- app/models/concerns/masks/adapter.rb
-- app/models/concerns/masks/role.rb
-- app/models/concerns/masks/scoped.rb
-- app/models/masks/access/actor_password.rb
-- app/models/masks/access/actor_scopes.rb
-- app/models/masks/access/actor_signup.rb
-- app/models/masks/actors/anonymous.rb
-- app/models/masks/actors/system.rb
-- app/models/masks/adapters/active_record.rb
-- app/models/masks/application_model.rb
-- app/models/masks/application_record.rb
-- app/models/masks/check.rb
-- app/models/masks/credential.rb
-- app/models/masks/credentials/access_token.rb
-- app/models/masks/credentials/backup_code.rb
-- app/models/masks/credentials/device.rb
-- app/models/masks/credentials/email.rb
-- app/models/masks/credentials/factor2.rb
-- app/models/masks/credentials/key.rb
-- app/models/masks/credentials/last_login.rb
-- app/models/masks/credentials/masquerade.rb
-- app/models/masks/credentials/nickname.rb
-- app/models/masks/credentials/one_time_code.rb
-- app/models/masks/credentials/password.rb
-- app/models/masks/credentials/recovery.rb
-- app/models/masks/credentials/return_to.rb
-- app/models/masks/credentials/session.rb
-- app/models/masks/device.rb
-- app/models/masks/error.rb
-- app/models/masks/event.rb
-- app/models/masks/mask.rb
-- app/models/masks/openid/authorization.rb
-- app/models/masks/openid/token.rb
-- app/models/masks/rails/actor.rb
-- app/models/masks/rails/actor_role.rb
-- app/models/masks/rails/device.rb
-- app/models/masks/rails/email.rb
-- app/models/masks/rails/key.rb
-- app/models/masks/rails/openid/access_token.rb
-- app/models/masks/rails/openid/authorization.rb
-- app/models/masks/rails/openid/client.rb
-- app/models/masks/rails/openid/id_token.rb
-- app/models/masks/rails/recovery.rb
-- app/models/masks/rails/role.rb
-- app/models/masks/rails/scope.rb
-- app/models/masks/session.rb
-- app/models/masks/sessions/access.rb
-- app/models/masks/sessions/inline.rb
-- app/models/masks/sessions/request.rb
-- app/resources/masks/actor_resource.rb
-- app/resources/masks/session_resource.rb
-- app/views/layouts/masks/application.html.erb
-- app/views/layouts/masks/mailer.html.erb
-- app/views/layouts/masks/mailer.text.erb
-- app/views/layouts/masks/manage.html.erb
-- app/views/masks/actor_mailer/recover_credentials.html.erb
-- app/views/masks/actor_mailer/recover_credentials.text.erb
-- app/views/masks/actor_mailer/verify_email.html.erb
-- app/views/masks/actor_mailer/verify_email.text.erb
-- app/views/masks/actors/current.html.erb
-- app/views/masks/application/_header.html.erb
-- app/views/masks/backup_codes/new.html.erb
-- app/views/masks/emails/new.html.erb
-- app/views/masks/emails/verify.html.erb
-- app/views/masks/keys/new.html.erb
-- app/views/masks/manage/actors/index.html.erb
-- app/views/masks/manage/actors/show.html.erb
-- app/views/masks/manage/clients/index.html.erb
-- app/views/masks/manage/clients/show.html.erb
-- app/views/masks/manage/dashboard/index.html.erb
-- app/views/masks/manage/devices/index.html.erb
-- app/views/masks/one_time_code/new.html.erb
-- app/views/masks/openid/authorizations/error.html.erb
-- app/views/masks/openid/authorizations/new.html.erb
-- app/views/masks/passwords/edit.html.erb
-- app/views/masks/recoveries/new.html.erb
-- app/views/masks/recoveries/password.html.erb
-- app/views/masks/sessions/new.html.erb
-- config/brakeman.ignore
-- config/initializers/inflections.rb
-- config/locales/en.yml
+- app/controllers/masks/rails/base_controller.rb
+- app/controllers/masks/rails/handshakes_controller.rb
+- app/controllers/masks/rails/sessions_controller.rb
+- app/views/layouts/masks/rails/plain.html.erb
+- app/views/masks/rails/handshakes/refused.html.erb
+- app/views/masks/rails/handshakes/show.html.erb
 - config/routes.rb
-- db/migrate/20231205173845_create_actors.rb
-- db/migrate/20240329182422_support_openid.rb
-- lib/generators/masks/install/USAGE
 - lib/generators/masks/install/install_generator.rb
-- lib/generators/masks/install/templates/initializer.rb
-- lib/generators/masks/install/templates/masks.json
+- lib/generators/masks/install/templates/masks.rb.tt
 - lib/masks.rb
-- lib/masks/configuration.rb
-- lib/masks/engine.rb
-- lib/masks/middleware.rb
+- lib/masks/client.rb
+- lib/masks/client/claims.rb
+- lib/masks/client/errors.rb
+- lib/masks/client/handshake.rb
+- lib/masks/client/http.rb
+- lib/masks/client/introspection.rb
+- lib/masks/client/issuer.rb
+- lib/masks/client/pkce.rb
+- lib/masks/client/rack.rb
+- lib/masks/client/registration.rb
+- lib/masks/client/registry.rb
+- lib/masks/client/resource.rb
+- lib/masks/client/session.rb
+- lib/masks/client/stores.rb
+- lib/masks/client/tokens.rb
+- lib/masks/client/tracker.rb
+- lib/masks/client/verifier.rb
+- lib/masks/rails.rb
+- lib/masks/rails/authentication.rb
+- lib/masks/rails/configurable.rb
+- lib/masks/rails/configuration.rb
+- lib/masks/rails/credentials.rb
+- lib/masks/rails/engine.rb
+- lib/masks/rails/protected_resource.rb
 - lib/masks/version.rb
-- lib/tasks/masks_tasks.rake
-- masks.json
-homepage: https://masks.geiger.to
+homepage: https://github.com/masksrb/masks
 licenses:
 - MIT
 metadata:
-  homepage_uri: https://masks.geiger.to
-  source_code_uri: https://github.com/geiger-to/masks
-  changelog_uri: https://masks.geiger.to/changelog
+  source_code_uri: https://github.com/masksrb/masks
+  changelog_uri: https://github.com/masksrb/masks/blob/main/client/CHANGELOG.md
   rubygems_mfa_required: 'true'
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - "~>"
+  - - ">="
     - !ruby/object:Gem::Version
-      version: '3.1'
+      version: '3.2'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.3
-signing_key: 
+rubygems_version: 3.6.9
 specification_version: 4
-summary: mask ruby applications with auth
+summary: Sign a Ruby or Rails app in against a masks issuer.
 test_files: []