masks 0.4.0 → 0.6.0

data/app/controllers/masks/manage/actors_controller.rb

@@ -1,83 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  # @visibility private
-  module Manage
-    class ActorsController < BaseController
-      section :actors
-
-      before_action :find_actor
-
-      def index
-        @pagy, @actors = pagy(actor_model.all)
-      end
-
-      def create
-        actor =
-          signup_access.signup(
-            nickname: params[:nickname],
-            password: params[:password]
-          )
-
-        if actor.valid?
-          redirect_to manage_actor_path(actor)
-        else
-          flash[:errors] = actor.errors.full_messages
-          redirect_to manage_actors_path
-        end
-      end
-
-      def update
-        actor_model.transaction do
-          if params[:add_scope]
-            @actor.assign_scopes!(params[:add_scope])
-            flash[:info] = "added scope \"#{params[:add_scope]}\""
-          elsif params[:remove_scope]
-            @actor.remove_scopes!(params[:remove_scope])
-            flash[:info] = "removed scope \"#{params[:remove_scope]}\""
-          elsif params[:remove_factor2]
-            @actor.remove_factor2!
-            flash[:info] = "removed second factor authentication"
-          elsif params[:logout]
-            @actor.logout!
-            flash[:info] = "logged out of all devices"
-          elsif password_param
-            password_access.change_password(password_param, actor: @actor)
-
-            if @actor.valid?
-              flash[:info] = "password changed"
-            else
-              flash[:error] = "invalid password"
-            end
-          end
-
-          redirect_to manage_actor_path(@actor)
-        end
-
-        @actor
-      end
-
-      private
-
-      def find_actor
-        @actor = actor_model.find_by(nickname: params[:actor])
-      end
-
-      def actor_model
-        Masks.configuration.model(:actor)
-      end
-
-      def signup_access
-        masked_session.access("actor.signup")
-      end
-
-      def password_access
-        masked_session.access("actor.password")
-      end
-
-      def password_param
-        params[:change_password]
-      end
-    end
-  end
-end

data/app/controllers/masks/manage/base_controller.rb

@@ -1,20 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  # @visibility private
-  module Manage
-    class BaseController < ApplicationController
-      layout "masks/manage"
-
-      class << self
-        def section(name)
-          before_action { @section = name }
-        end
-      end
-
-      helper_method :current_actor, :section
-
-      attr_accessor :section
-    end
-  end
-end

data/app/controllers/masks/manage/clients_controller.rb

@@ -1,84 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  # @visibility private
-  module Manage
-    class ClientsController < BaseController
-      section :clients
-
-      before_action :find_client, only: %i[show update destroy]
-
-      rescue_from Pagy::OverflowError do
-        redirect_to manage_clients_path
-      end
-
-      def index
-        @pagy, @clients =
-          pagy(Masks::Rails::OpenID::Client.all.order(created_at: :desc))
-      end
-
-      def create
-        client =
-          Masks.configuration.model(:openid_client).new(name: params[:name])
-
-        if client.save
-          redirect_to manage_client_path(client)
-        else
-          flash[:errors] = client.errors.full_messages
-
-          redirect_to manage_clients_path
-        end
-      end
-
-      def update
-        Masks
-          .configuration
-          .model(:openid_client)
-          .transaction do
-            if params[:add_scope]
-              @client.assign_scopes!(params[:add_scope])
-              flash[:info] = "added scope"
-            elsif params[:remove_scope]
-              @client.remove_scopes!(params[:remove_scope])
-              flash[:info] = "removed scope"
-            else
-              update_client
-            end
-
-            redirect_to manage_client_path(@client)
-          end
-      end
-
-      def destroy
-        @client.destroy
-
-        flash[:destroyed] = @client.name
-
-        redirect_to manage_clients_path
-      end
-
-      private
-
-      def update_client
-        @client.name = params[:name]
-        @client.secret = params[:secret]
-        @client.consent = params[:consent]
-        @client.redirect_uris = params[:redirect_uris].split("\n")
-        @client.subject_type = params[:subject_type]
-        @client.code_expires_in = params[:code_expires_in]
-        @client.token_expires_in = params[:token_expires_in]
-        @client.refresh_expires_in = params[:refresh_expires_in]
-        @client.save
-
-        return if @client.valid?
-
-        flash[:errors] = @client.errors.full_messages
-      end
-
-      def find_client
-        @client =
-          Masks.configuration.model(:openid_client).find_by(key: params[:id])
-      end
-    end
-  end
-end

data/app/controllers/masks/manage/dashboard_controller.rb

@@ -1,15 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  # @visibility private
-  module Manage
-    class DashboardController < BaseController
-      section :dashboard
-
-      def index
-        @clients = Masks.configuration.model(:openid_client).count
-        @actors = Masks.configuration.model(:actor).count
-      end
-    end
-  end
-end

data/app/controllers/masks/manage/devices_controller.rb

@@ -1,19 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  # @visibility private
-  module Manage
-    class DevicesController < BaseController
-      section :devices
-
-      rescue_from Pagy::OverflowError do
-        redirect_to manage_devices_path
-      end
-
-      def index
-        @pagy, @devices =
-          pagy(Masks.configuration.model(:device).all.order(created_at: :desc))
-      end
-    end
-  end
-end

data/app/controllers/masks/one_time_code_controller.rb

@@ -1,49 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  # @visibility private
-  class OneTimeCodeController < ApplicationController
-    require_mask type: :session, only: :new
-
-    before_action only: %i[create destroy] do
-      require_sudo(one_time_code_path)
-    end
-
-    def new
-      respond_to { |format| format.html { render(:new) } }
-    end
-
-    def create
-      if secret_param && code_param
-        @actor.totp_secret = secret_param
-        @actor.totp_code = code_param
-        @actor.save if @actor.valid?
-
-        flash[:errors] = @actor.errors.full_messages unless @actor.valid?
-      end
-
-      respond_to { |format| format.html { redirect_to one_time_code_path } }
-    end
-
-    def destroy
-      @actor.totp_secret = nil
-      @actor.save if @actor.valid?
-
-      respond_to { |format| format.html { redirect_to one_time_code_path } }
-    end
-
-    private
-
-    def create_params
-      params.require(:one_time_code).permit(:code, :secret)
-    end
-
-    def code_param
-      create_params[:code]
-    end
-
-    def secret_param
-      create_params[:secret]
-    end
-  end
-end

data/app/controllers/masks/openid/authorizations_controller.rb

@@ -1,45 +0,0 @@
-# frozen_string_literal: true
-module Masks
-  module OpenID
-    class AuthorizationsController < ApplicationController
-      rescue_from Rack::OAuth2::Server::Authorize::BadRequest do |e|
-        @error = e
-
-        render :error, status: e.status
-      end
-
-      def new
-        authorize
-      end
-
-      def create
-        authorize approved: params[:approve]
-      end
-
-      private
-
-      def authorize(**opts)
-        # TODO: support incoming id_token request object + max_age parameter
-        @authorization = Authorization.perform(request.env, **opts)
-
-        _status, header, = @authorization.response
-
-        if header["WWW-Authenticate"].present?
-          headers["WWW-Authenticate"] = header["WWW-Authenticate"]
-        end
-
-        if header["Location"]
-          return redirect_to header["Location"], allow_other_host: true
-        end
-
-        unless @authorization.actor
-          session[:return_to] = request.url
-
-          return redirect_to session_path
-        end
-
-        render :new
-      end
-    end
-  end
-end

data/app/controllers/masks/openid/discoveries_controller.rb

@@ -1,55 +0,0 @@
-# frozen_string_literal: true
-module Masks
-  module OpenID
-    class DiscoveriesController < ApplicationController
-      before_action :find_client
-
-      def jwks
-        jwks =
-          JSON::JWK::Set.new(
-            JSON::JWK.new(client.public_key, use: :sig, kid: client.kid)
-          )
-
-        render json: jwks
-      end
-
-      def new
-        render json:
-                 OpenIDConnect::Discovery::Provider::Config::Response.new(
-                   issuer: client.issuer,
-                   authorization_endpoint: openid_authorization_url,
-                   token_endpoint: openid_token_url,
-                   userinfo_endpoint: openid_userinfo_url,
-                   jwks_uri: openid_jwks_url,
-                   #  registration_endpoint: site_url, # TODO
-                   scopes_supported: client.scopes,
-                   response_types_supported: client.response_types,
-                   grant_types_supported: client.grant_types,
-                   claims_parameter_supported: false,
-                   request_parameter_supported: false,
-                   request_uri_parameter_supported: false,
-                   subject_types_supported: [
-                     client.pairwise_subject? ? "pairwise" : "public"
-                   ],
-                   id_token_signing_alg_values_supported: [:RS256],
-                   token_endpoint_auth_methods_supported: %w[
-                     client_secret_basic
-                     client_secret_post
-                   ],
-                   claims_supported: %w[sub iss name email address phone_number]
-                 )
-      end
-
-      private
-
-      def find_client
-        head :not_found unless client
-      end
-
-      def client
-        @client ||=
-          Masks.configuration.model(:openid_client).find_by(key: params[:id])
-      end
-    end
-  end
-end

data/app/controllers/masks/openid/tokens_controller.rb

@@ -1,45 +0,0 @@
-# frozen_string_literal: true
-module Masks
-  module OpenID
-    class TokensController < ApplicationController
-      rescue_from Rack::OAuth2::Server::Authorize::BadRequest do |e|
-        @error = e
-
-        render :error, status: e.status
-      end
-
-      def new
-        authorize
-      end
-
-      def create
-        authorize approved: params[:approve]
-      end
-
-      private
-
-      def authorize(**opts)
-        # TODO: support incoming id_token request object + max_age parameter
-        @authorization = Authorization.perform(request.env, **opts)
-
-        unless @authorization.actor
-          session[:return_to] = request.url
-
-          return redirect_to session_path
-        end
-
-        _status, header, = @authorization.response
-
-        if header["WWW-Authenticate"].present?
-          headers["WWW-Authenticate"] = header["WWW-Authenticate"]
-        end
-
-        if header["Location"]
-          redirect_to header["Location"]
-        else
-          render :new
-        end
-      end
-    end
-  end
-end

data/app/controllers/masks/openid/userinfo_controller.rb

@@ -1,28 +0,0 @@
-# frozen_string_literal: true
-module Masks
-  module OpenID
-    class UserInfoController < ApplicationController
-      def show
-        claims = { sub: openid_client.subject(current_actor) }
-
-        if access_token.scope?("email")
-          claims[:email] = current_actor.primary_email&.email
-        end
-
-        if access_token.scope?("phone")
-          claims[:phone] = current_actor.phone_number
-        end
-
-        render json: OpenIDConnect::ResponseObject::UserInfo.new(claims)
-      end
-
-      private
-
-      def access_token
-        @access_token ||= masked_session.extra(:access_token)
-      end
-
-      delegate :openid_client, to: :access_token
-    end
-  end
-end

data/app/controllers/masks/passwords_controller.rb

@@ -1,33 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  # @visibility private
-  class PasswordsController < ApplicationController
-    require_mask type: :session, only: :edit
-    require_access "actor.password", only: :update
-
-    before_action only: %i[update] do
-      require_sudo(password_path)
-    end
-
-    def edit
-      respond_to { |format| format.html { render(:edit) } }
-    end
-
-    def update
-      if password_param
-        current_access.change_password(password_param)
-
-        flash[:errors] = @actor.errors.full_messages unless @actor.valid?
-      end
-
-      respond_to { |format| format.html { redirect_to password_path } }
-    end
-
-    private
-
-    def password_param
-      params.dig(:password, :change)
-    end
-  end
-end

data/app/controllers/masks/recoveries_controller.rb

@@ -1,43 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  # @visibility private
-  class RecoveriesController < ApplicationController
-    before_action :redirect_if_logged_in, only: %i[new]
-
-    def new
-      respond_to { |format| format.html { render(:new) } }
-    end
-
-    def create
-      flash[:recovery] = true
-
-      respond_to { |format| format.html { redirect_to recover_path } }
-    end
-
-    def password
-      @recovery = masked_session.extra(:recovery)
-
-      respond_to { |format| format.html { render(:password) } }
-    end
-
-    def reset
-      @recovery = masked_session.extra(:recovery)
-
-      flash[:reset] = true if @recovery&.destroyed?
-      flash[:errors] = @recovery.errors.full_messages if @recovery &&
-        !@recovery&.valid?
-
-      redirect =
-        @recovery ? recover_password_path(token: @recovery.token) : recover_path
-
-      respond_to { |format| format.html { redirect_to redirect } }
-    end
-
-    private
-
-    def redirect_if_logged_in
-      redirect_to Masks.configuration.site_links[:root] if current_actor
-    end
-  end
-end

data/app/controllers/masks/sessions_controller.rb

@@ -1,53 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  # @visibility private
-  class SessionsController < ApplicationController
-    def new
-      respond_to do |format|
-        format.json { render json: resource_cls.new(masked_session) }
-        format.html { render(:new) }
-      end
-    end
-
-    def create
-      flash[
-        :errors
-      ] = masked_session.errors.full_messages unless request.format == :json
-
-      respond_to do |format|
-        format.json { render json: resource_cls.new(masked_session) }
-        format.html do
-          path =
-            (
-              if masked_session.passed?
-                session.delete(:return_to) || masked_session.mask.pass ||
-                  Masks.configuration.site_links[:after_login]
-              else
-                masked_session.mask.fail ||
-                  Masks.configuration.site_links[:login]
-              end
-            )
-          redirect_to path
-        end
-      end
-    end
-
-    def destroy
-      masked_session.cleanup!
-
-      respond_to do |format|
-        format.json { render json: resource_cls.new(masked_session) }
-        format.html do
-          redirect_to Masks.configuration.site_links[:after_logout]
-        end
-      end
-    end
-
-    private
-
-    def resource_cls
-      Masks.configuration.model(:session_json)
-    end
-  end
-end

data/app/helpers/masks/application_helper.rb

@@ -1,49 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  # @visibility private
-  module ApplicationHelper
-    include Pagy::Frontend
-
-    def totp_svg(uri, **opts)
-      qrcode = RQRCode::QRCode.new(uri)
-      raw qrcode.as_svg(**opts)
-    end
-
-    def device_icon(device)
-      case device.device_type
-      when "desktop"
-        "computer"
-      when "smartphone", "feature phone"
-        "smartphone"
-      when "tablet", "phablet", "portable media player"
-        "tablet"
-      when "console"
-        "gamepad"
-      when "tv", "smart display"
-        "tv-2"
-      when "car browser"
-        "car"
-      when "camera"
-        "camera"
-      when "smart speaker", "wearable", "peripheral"
-        "bluetooth"
-      else
-        "question-circle"
-      end
-    end
-
-    def logged_in?
-      @session&.passed? && @session&.actor && !@session.actor.anonymous?
-    end
-
-    def factor2_required?
-      checks = @session.checks_for(:session)
-
-      return false unless checks
-
-      checks[:factor2] && !checks[:factor2]&.passed? &&
-        checks[:actor]&.passed? && checks[:password]&.passed?
-    end
-  end
-end

data/app/jobs/masks/application_job.rb

@@ -1,7 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  # @visibility private
-  class ApplicationJob < ActiveJob::Base
-  end
-end

data/app/jobs/masks/expire_actors_job.rb

@@ -1,15 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  # Job for deleting actors that have passed their expiration time.
-  #
-  # This job effectively delegates its work to the configured
-  # +Masks::Adapter+, specifically calling +#expire_actors+.
-  #
-  # @see Masks::Adapter Masks::Adapter
-  class ExpireActorsJob < ApplicationJob
-    def perform
-      Masks.configuration.expire_actors
-    end
-  end
-end

data/app/jobs/masks/expire_recoveries_job.rb

@@ -1,15 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  # Job for deleting recovies requests that passed their expiration time.
-  #
-  # This job delegates its work to the configured
-  # +Masks::Adapter+, specifically calling +#expire_recoveries+.
-  #
-  # @see Masks::Adapter Masks::Adapter
-  class ExpireRecoveriesJob < ApplicationJob
-    def perform
-      Masks.configuration.expire_recoveries
-    end
-  end
-end

data/app/mailers/masks/actor_mailer.rb

@@ -1,22 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  # @visibility private
-  class ActorMailer < ApplicationMailer
-    layout "masks/mailer"
-
-    def verify_email
-      @config = Masks.configuration
-      @email = params[:email]
-
-      mail(to: @email.email, subject: t(".subject"))
-    end
-
-    def recover_credentials
-      @config = Masks.configuration
-      @recovery = @config.find_recovery(nil, id: params[:recovery])
-
-      mail(to: @recovery.to, subject: t(".subject"))
-    end
-  end
-end