masks 0.4.0 → 0.6.0

data/app/models/masks/credentials/nickname.rb

@@ -1,63 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  module Credentials
-    # Checks for an :actor given a matching nickname.
-    class Nickname < Masks::Credential
-      checks :actor
-
-      delegate :actor_id, :nickname, to: :actor, allow_nil: true
-
-      validates :nickname, :actor, presence: true
-      validate :validates_custom, if: :nickname
-
-      def lookup
-        return if actor
-
-        actor =
-          (
-            if nickname_param
-              config.find_actor(session, nickname: nickname_param)
-            end
-          )
-        actor ||=
-          if nickname_param
-            config
-              .build_actor(session, nickname: nickname_param)
-              .tap { |actor| actor.signup = true }
-          end
-
-        if actor&.new_record?
-          actor.nickname =
-            prefix_nickname(actor.nickname, default: actor.nickname)
-        end
-
-        actor
-      end
-
-      def maskup
-        approve! if valid?
-      end
-
-      private
-
-      def nickname_param
-        @nickname_param ||=
-          prefix_nickname(
-            session_params[:nickname],
-            default: session_params[:nickname]
-          )
-      end
-
-      def validates_custom
-        return unless nickname
-
-        validates_length :nickname, nickname_config&.length
-
-        return unless nickname_format
-
-        errors.add(:nickname, :format) unless nickname_format.match?(nickname)
-      end
-    end
-  end
-end

data/app/models/masks/credentials/one_time_code.rb

@@ -1,34 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  module Credentials
-    # Checks :factor2 for a valid one-time code.
-    class OneTimeCode < Masks::Credential
-      include Factor2
-
-      private
-
-      def param
-        :one_time_code
-      end
-
-      def secret
-        actor&.totp_secret
-      end
-
-      def verify(code)
-        valid_code?(code, secret)
-      end
-
-      def valid_code?(code, secret)
-        if code && secret
-          actor.totp.verify(code)
-        else
-          false
-        end
-      rescue OpenSSL::HMACError
-        false
-      end
-    end
-  end
-end

data/app/models/masks/credentials/password.rb

@@ -1,28 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  module Credentials
-    # Checks :password for a match.
-    class Password < Masks::Credential
-      checks :password
-
-      def lookup
-        actor.password = password if actor&.new_record? && password
-
-        nil
-      end
-
-      def maskup
-        return unless password
-
-        actor&.authenticate(password) && actor&.valid? ? approve! : deny!
-      end
-
-      private
-
-      def password
-        session_params[:password]
-      end
-    end
-  end
-end

data/app/models/masks/credentials/recovery.rb

@@ -1,71 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  module Credentials
-    # Checks for a :recovery on the session.
-    class Recovery < Masks::Credential
-      checks :recovery
-
-      def lookup
-        return if actor
-
-        @recovery =
-          if recovery_key
-            config.find_recovery(session, token: recovery_key)
-          else
-            config.build_recovery(
-              session,
-              nickname: nickname_param,
-              email: email_param,
-              phone: phone_param,
-              value: recovery_value
-            )
-          end
-
-        session.extras(recovery: @recovery)
-
-        @recovery&.actor
-      end
-
-      def maskup
-        return unless valid? && actor
-
-        if recovery_key
-          if recovery_password && @recovery&.valid?
-            @recovery.reset_password!(recovery_password)
-            approve!
-          end
-        elsif recovery_value && @recovery&.valid?
-          @recovery.notify!
-        end
-      end
-
-      private
-
-      def recovery_value
-        params.dig(:recover, :value) if writable?
-      end
-
-      def recovery_key
-        params[:token]
-      end
-
-      def recovery_password
-        params.dig(:recover, :password) if writable?
-      end
-
-      def phone_param
-        @phone_param ||= Phonelib.valid?(recovery_value) ? recovery_value : nil
-      end
-
-      def email_param
-        @email_param ||=
-          ValidateEmail.valid?(recovery_value) ? recovery_value : nil
-      end
-
-      def nickname_param
-        @nickname_param ||= prefix_nickname(recovery_value, default: nil)
-      end
-    end
-  end
-end

data/app/models/masks/credentials/return_to.rb

@@ -1,27 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  module Credentials
-    # Assigns the request URL to session data, under the key +return_to+.
-    #
-    # This credential is intended to keep track of an actor's attempts to
-    # access protected resources, so it only assigns the value if the session
-    # has not passed.
-    #
-    # In some cases, you may want to selectively disable the functionality
-    # of this credential. To do so, set +return_to+ to +false+ in the
-    # mask configuration.
-    class ReturnTo < Masks::Credential
-      def backup
-        return if session&.passed?
-        return unless session.try(:request) && session.request.get?
-        if session.mask.extras.key?(:return_to) &&
-             !session.mask.extras[:return_to]
-          return
-        end
-
-        session.data[:return_to] = session.request.url
-      end
-    end
-  end
-end

data/app/models/masks/credentials/session.rb

@@ -1,67 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  module Credentials
-    # Checks for past :actor(s) on a session.
-    #
-    # This can be used in lieu of supplying identifying details like an
-    # email/nickname (usually provided they were supplied in the past).
-    class Session < Masks::Credential
-      checks :actor
-
-      def lookup
-        return if session_params[:actor_id]
-
-        actor_ids = session.data[:actors]&.keys || []
-        actor_id = session.data[:actor]
-        actors = (actor_ids.any? ? config.find_actors(session, actor_ids) : [])
-
-        # only lookup and return the current actor if
-        # it's not provided via a param (e.g. someone
-        # is trying to login)
-        actor =
-          if actor_id
-            actors.find do |a|
-              a.actor_id == actor_id &&
-                a.session_key == session.data[:actors][a.actor_id]
-            end
-          end
-
-        actor = Actors::Anonymous.new(session:) if optional? && !actors.present?
-
-        actor
-      end
-
-      def maskup
-        return approve! if optional? && actor&.anonymous?
-
-        actor_id = actor&.actor_id
-
-        return unless actor_id && session.data[:actors]&.fetch(actor_id, nil)
-        return unless session.data[:actor] == actor_id
-
-        if session.data.dig(:actors, actor_id) == actor.session_key
-          approve!
-        else
-          cleanup
-        end
-      end
-
-      def backup
-        return unless actor && passed?
-
-        session.data[:actors] ||= {}
-        session.data[:actors][actor.actor_id] = actor.session_key
-        session.data[:actor] = actor.actor_id
-      end
-
-      def cleanup
-        actor_id = actor&.actor_id || session.data[:actor]
-
-        session.data[:actor] = nil
-        session.data[:actors] ||= {}
-        session.data[:actors].delete(actor_id)
-      end
-    end
-  end
-end

data/app/models/masks/device.rb

@@ -1,30 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  # Represents a device, used for interacting with a session.
-  #
-  # Device detection is optionally added with the +Device+ credential,
-  # using the +device-detector+ gem.
-  #
-  # @see Masks::Credentials::Device Masks::Credentials::Device
-  class Device < ApplicationModel
-    attribute :session
-
-    def fingerprint
-      return unless detector.known?
-
-      input = [
-        detector.name,
-        detector.os_name,
-        detector.device_name,
-        detector.device_type
-      ].compact.join("-")
-
-      Digest::SHA512.hexdigest(input)
-    end
-
-    def detector
-      @detector ||= DeviceDetector.new(session.user_agent)
-    end
-  end
-end

data/app/models/masks/error.rb

@@ -1,51 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  module Error
-    # Base class for Masks errors
-    class Base < RuntimeError
-    end
-
-    # Thrown when a session is required but not provided
-    class InvalidSession < Base
-      def initialize
-        super("a session was expected, but none was provided")
-      end
-    end
-
-    # Thrown when invalid configuration is detected
-    class InvalidConfiguration < Base
-      def initialize(value)
-        super("cannot use '#{value}' for masks.json")
-      end
-    end
-
-    # Thrown when configuration is not found
-    class ConfigurationNotFound < Base
-      def initialize
-        super("cannot find masks.json")
-      end
-    end
-
-    # Thrown when Masks encounters an unauthorized session
-    class Unauthorized < Base
-      def initialize
-        super("unauthorized")
-      end
-    end
-
-    # Thrown when Masks cannot find a mask for a session
-    class UnknownMask < Base
-      def initialize(session)
-        super("could not determine mask for #{session}")
-      end
-    end
-
-    # Thrown when Masks cannot find an access class for the given name
-    class UnknownAccess < Base
-      def initialize(name)
-        super("could not determine access class for #{name}")
-      end
-    end
-  end
-end

data/app/models/masks/event.rb

@@ -1,14 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  # Publishes events using +ActiveSupport::Notifications+
-  class Event
-    class << self
-      def emit(name, **opts, &block)
-        ActiveSupport::Notifications.instrument("masks.#{name}", **opts) do
-          block.call
-        end
-      end
-    end
-  end
-end

data/app/models/masks/mask.rb

@@ -1,266 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  # Represents an individual mask, its properties, and methods for interpreting them.
-  #
-  # When a session is created it finds the first matching mask to use for
-  # dictating how to control access. A Mask contains rules that allow sessions
-  # to match them.
-  #
-  # @see Masks::Check Masks::Check
-  # @see Masks::Credentials Masks::Credentials
-  class Mask < ApplicationModel
-    # @!attribute [rw] name
-    #   a unique name for the mask
-    #   @return [String]
-    attribute :name
-    # @!attribute [rw] skip
-    #   Whether or not to skip processing by masks
-    #   @return [Boolean]
-    attribute :skip, default: false
-    # @!attribute [rw] type
-    #   A type name to inherit configuration from
-    #   @return [String]
-    attribute :type
-    # @!attribute [rw] types
-    #   A list of required type names
-    #   @return [String]
-    attribute :types
-    # @!attribute [rw] checks
-    #   A hash of checks required to pass the session
-    #   @return [Hash]
-    attribute :checks
-    # @!attribute [rw] credentials
-    #   An array of credentials that will check the session
-    #   @return [Array<Class>]
-    attribute :credentials
-    # @!attribute [rw] scopes
-    #   An array of scopes required to access the session
-    #   @return [Array<String>]
-    attribute :scopes
-    # @!attribute [rw] request
-    #   A hash of properties an HTTP request must match to use this mask
-    #   @return [Hash]
-    attribute :request
-    # @!attribute [rw] access
-    #   A list of access classes allowed during this session
-    #   @return [Array<String>]
-    attribute :access
-    # @!attribute [rw] actor
-    #   The expected class name of the actor using the sesssion, as a string
-    #   @return [String]
-    attribute :actor
-    # @!attribute [rw] anon
-    #   Whether or not to allow "anonymous" actors
-    #   @return [Boolean]
-    attribute :anon
-    # @!attribute [rw] pass
-    #   What to do when the session passes, typically a redirect uri
-    #   @return [String]
-    attribute :pass, default: "/"
-    # @!attribute [rw] fail
-    #   What to do when the session is failed by checks, credentials, or another error
-    #   @return [String|Boolean]
-    attribute :fail, default: true
-    # @!attribute [rw] backup
-    #   Whether or not to save results of masks
-    #   @return [Boolean]
-    attribute :backup, default: true
-    # @!attribute [rw] extras
-    #   Extra attributes and configuration accessible on the mask
-    #   @return [Hash]
-    attribute :extras, default: -> { {} }
-
-    # @visibility private
-    attribute :config
-
-    # @visibility private
-    def initialize(attrs = {})
-      if attrs[:type]
-        type = attrs[:config].mask(attrs[:type])
-        attrs = type.deep_merge(**attrs)
-      end
-
-      # required for `attribute_names` to work
-      super({})
-
-      extras = attrs.except(*attribute_names.map(&:to_sym))
-      attrs = attrs.slice(*attribute_names.map(&:to_sym))
-      attrs[:extras] = extras.deep_symbolize_keys
-
-      assign_attributes(**attrs)
-    end
-
-    # Returns the class name expected for any actor attached to this session.
-    #
-    # @return [String]
-    def actor
-      super || config.models[:actor]
-    end
-
-    # Returns the constantized version of +#actor+.
-    #
-    # @return [String]
-    def actor_scope
-      (actor.constantize unless skip?)
-    end
-
-    # Whether or not sessions matching this mask should skip all work.
-    #
-    # @return [Boolean]
-    def skip?
-      !!skip
-    end
-
-    # Whether or not anonymous actors are allowed in the session.
-    #
-    # @return [Boolean]
-    def allow_anonymous?
-      anon
-    end
-
-    # Whether or not sessions using this mask should be saved.
-    #
-    # Some masks definitely want this enabled, as it is what stores the results
-    # of masks, credentials, and checks in the rails session. In other cases, it
-    # is not necessary, for example when verifying an API key.
-    def backup?
-      return false if skip?
-
-      !!backup
-    end
-
-    # A hash of check configuration, keyed by their name.
-    #
-    # @return [Hash]
-    def checks
-      return {} if skip?
-
-      (type_config&.fetch(:checks, {}) || {}).merge(super || {})
-    end
-
-    # Converts credentials to classes before returning the list.
-    #
-    # @return [Array<Class>]
-    # @raise Masks::Error::InvalidConfiguration
-    def credentials
-      return [] if skip?
-
-      merged = [
-        *(type_config&.fetch(:credentials, []) || []),
-        *(super || [])
-      ].uniq
-      merged.map do |cls|
-        case cls
-        when Class
-          cls
-        when /:+/
-          cls.constantize
-        when String
-          "Masks::Credentials::#{cls}".constantize
-        else
-          raise Masks::Error::InvalidConfiguration, cls
-        end
-      end
-    end
-
-    # Returns whether or not the mask matches the passed session.
-    #
-    # The behaviour of this method depends on the mask's configuration.  For
-    # example, a session with an anonymous actor will return true only if the
-    # mask's +#allow_anonymous?+ method returns true.
-    #
-    # @param [Masks::Session] session
-    # @return [Boolean]
-    def matches_session?(session)
-      actor = session.actor
-
-      return false unless actor
-      return true if actor.anonymous? && allow_anonymous?
-
-      case self.actor
-      when String
-        return false unless actor.is_a?(self.actor.constantize)
-      when Class
-        return false unless actor.is_a?(self.actor)
-      else
-        return false unless actor.is_a?(config.model(:actor))
-      end
-
-      matches_scopes?(session.scopes)
-    end
-
-    # Returns whether or not the mask's request confiig matches the request passed.
-    #
-    # The following parameters are supported in the +request+ hash:
-    #
-    # - +path+ - if specified, the request path must be in this list.
-    # - +method+ - if specified, the request method must be in this list.
-    # - +param+ - if specified, the key must exist in the session params.
-    # - +header+ - if specified, the header must be present in the request.
-    #
-    # @return [Boolean]
-    def matches_request?(request)
-      return false unless self.request
-      return false unless matches_path?(request)
-      return false unless matches_method?(request)
-
-      param = self.request.fetch(:param, nil)
-
-      if param && param != "*" && !request.params&.fetch(param.to_sym, nil)
-        return false
-      end
-
-      header = self.request.fetch(:header, nil)
-
-      return false if header && !request.headers[header]
-
-      true
-    end
-
-    private
-
-    # Returns whether or not the mask's allowed scopes includes one of the scopes passed.
-    #
-    # @return [Boolean]
-    def matches_scopes?(scopes)
-      return true if self.scopes.blank?
-
-      # the mask scopes and scopes passed should have at least one match
-      # otherwise this will return false because the intersection is blank
-      (Array.wrap(self.scopes) & (scopes || [])).present?
-    end
-
-    def matches_path?(request)
-      return true unless (paths = self.request.fetch(:path, nil))
-
-      Array
-        .wrap(paths)
-        .any? do |path|
-          case path
-          when /^r.+/
-            Regexp.new(path.slice(1..)).match?(request.url)
-          else
-            Fuzzyurl.matches?(Fuzzyurl.mask(path:), request.url)
-          end
-        end
-    end
-
-    def matches_method?(request)
-      return true unless (methods = self.request&.fetch(:method, nil))
-      return true if !methods || methods == "*"
-
-      Array
-        .wrap(methods)
-        .map(&:upcase)
-        .any? do |m|
-          m == request.method ||
-            (request.method == "POST" && request.params[:_method]&.upcase == m)
-        end
-    end
-
-    def type_config
-      @type_config ||= config.mask(type) if type
-    end
-  end
-end