masks 0.4.0 → 0.6.0

data/app/models/masks/rails/openid/client.rb

@@ -1,186 +0,0 @@
-# frozen_string_literal: true
-module Masks
-  module Rails
-    module OpenID
-      class Client < ApplicationRecord
-        include Masks::Scoped
-
-        self.table_name = "openid_clients"
-
-        validates :name, presence: true
-
-        after_initialize :generate_credentials
-        before_validation :generate_key, on: :create
-
-        serialize :scopes, coder: JSON
-        serialize :redirect_uris, coder: JSON
-        serialize :response_types, coder: JSON
-        serialize :grant_types, coder: JSON
-
-        validates :key, :secret, :scopes, presence: true
-        validates :key, uniqueness: true
-        validates :client_type,
-                  inclusion: {
-                    in: %w[public confidential]
-                  },
-                  presence: true
-        validates :subject_type,
-                  inclusion: {
-                    in: Masks.configuration.openid[:subject_types]
-                  },
-                  presence: true
-        validate :validate_expiries
-
-        has_many :access_tokens,
-                 class_name: Masks.configuration.models[:openid_access_token],
-                 inverse_of: :openid_client
-        has_many :authorizations,
-                 class_name: Masks.configuration.models[:openid_authorization],
-                 inverse_of: :openid_client
-        has_many :saved_roles,
-                 class_name: Masks.configuration.models[:role],
-                 autosave: true
-
-        def to_param
-          key
-        end
-
-        def response_types
-          case client_type
-          when "confidential"
-            ["code"]
-          when "public"
-            ["token", "id_token", "id_token token"]
-          end
-        end
-
-        def grant_types
-          case client_type
-          when "confidential"
-            %w[refresh_token authorization_code client_credentials]
-          else
-            []
-          end
-        end
-
-        def scopes
-          self[:scopes]
-        end
-
-        def roles(record, **opts)
-          case record
-          when Class, String
-            saved_roles.where(record_type: record.to_s, **opts).includes(
-              :record
-            )
-          else
-            saved_roles.where(record:, **opts)
-          end
-        end
-
-        def issuer
-          Masks::Engine.routes.url_helpers.openid_issuer_url(
-            id: key,
-            host: Masks.configuration.site_url
-          )
-        end
-
-        def kid
-          :default
-        end
-
-        def private_key
-          OpenSSL::PKey::RSA.new(rsa_private_key)
-        end
-
-        delegate :public_key, to: :private_key
-
-        def subject(actor)
-          case subject_type
-          when "nickname"
-            actor.nickname
-          else
-            Digest::SHA256.hexdigest(
-              [
-                sector_identifier,
-                actor.actor_id,
-                Masks.configuration.openid[:pairwise_salt]
-              ].join("/")
-            )
-          end
-        end
-
-        def audience
-          key
-        end
-
-        def auto_consent?
-          !consent
-        end
-
-        def pairwise_subject?
-          sector_identifier && subject_type == "pairwise"
-        end
-
-        def assign_scopes!(*scopes)
-          self.scopes = [*scopes, *self.scopes].uniq.compact
-          save!
-        end
-
-        def remove_scopes!(*scopes)
-          scopes.each { |scope| self.scopes.delete(scope) }
-
-          save!
-        end
-
-        def code_expires_at
-          Time.now + ChronicDuration.parse(code_expires_in)
-        end
-
-        def token_expires_at
-          Time.now + ChronicDuration.parse(token_expires_in)
-        end
-
-        def refresh_expires_at
-          Time.now + ChronicDuration.parse(refresh_expires_in)
-        end
-
-        private
-
-        def generate_credentials
-          self.secret ||= SecureRandom.uuid
-          self.client_type ||= "confidential"
-          self.subject_type ||= "nickname"
-          self.scopes ||= Masks.configuration.openid[:scopes] || []
-          self.rsa_private_key ||= OpenSSL::PKey::RSA.generate(2048).to_pem
-          self.sector_identifier ||=
-            URI.parse(Masks.configuration.site_url).host
-          self.code_expires_in ||= "5 minutes"
-          self.token_expires_in ||= "1 day"
-          self.refresh_expires_in ||= "1 week"
-        end
-
-        def generate_key
-          return unless name
-
-          key = name.parameterize
-          count = self.class.where("key LIKE ?", "#{key}%").count
-
-          self.key = count.positive? ? "#{key}-#{count + 1}" : key
-        end
-
-        def validate_expiries
-          %i[
-            code_expires_in
-            token_expires_in
-            refresh_expires_in
-          ].each do |param|
-            unless ChronicDuration.parse(send(param))
-              errors.add(param, :invalid)
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/app/models/masks/rails/openid/id_token.rb

@@ -1,43 +0,0 @@
-# frozen_string_literal: true
-module Masks
-  module Rails
-    module OpenID
-      class IdToken < ApplicationRecord
-        self.table_name = "openid_id_tokens"
-
-        belongs_to :actor, class_name: Masks.configuration.models[:actor]
-        belongs_to :openid_client,
-                   class_name: Masks.configuration.models[:openid_client]
-
-        def to_response_object(with = {})
-          subject =
-            if openid_client.pairwise_subject?
-              openid_client.subject_for(actor)
-            else
-              actor.actor_id
-            end
-
-          claims = {
-            sub: subject,
-            iss: openid_client.issuer,
-            aud: openid_client.audience,
-            exp: expires_at.to_i,
-            iat: created_at.to_i,
-            nonce:
-          }
-
-          id_token = OpenIDConnect::ResponseObject::IdToken.new(claims)
-          id_token.code = with[:code] if with[:code]
-          id_token.access_token = with[:access_token] if with[:access_token]
-          id_token
-        end
-
-        def to_jwt(with = {})
-          to_response_object(with).to_jwt(openid_client.private_key) do |jwt|
-            jwt.kid = openid_client.kid
-          end
-        end
-      end
-    end
-  end
-end

data/app/models/masks/rails/recovery.rb

@@ -1,116 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  module Rails
-    class Recovery < ApplicationRecord
-      self.table_name = "recoveries"
-
-      scope :recent,
-            lambda {
-              where(
-                "created_at >= ?",
-                Masks.configuration.lifetimes[:recovery_email]&.ago ||
-                  1.hour.ago
-              )
-            }
-      scope :expired,
-            lambda {
-              where(
-                "created_at < ?",
-                Masks.configuration.lifetimes[:recovery_email]&.ago ||
-                  1.hour.ago
-              )
-            }
-
-      belongs_to :actor, class_name: Masks.configuration.models[:actor]
-
-      validates :token, presence: true, uniqueness: { scope: :actor_id }
-      validates :contact, presence: true, if: :actor
-      validate :validates_actor
-
-      attribute :configuration
-      attribute :session
-      attribute :value
-
-      after_initialize :generate_token
-      after_initialize :load_actor, unless: :actor_id
-
-      def to
-        case contact
-        when Email
-          contact.email
-        end
-      end
-
-      def notified?
-        notified_at.present?
-      end
-
-      def reset_password!(password)
-        return unless actor && persisted?
-
-        actor.password = password
-
-        return unless actor.valid?
-
-        actor.save!
-        destroy!
-      end
-
-      def notify!
-        return if !valid? || notified?
-
-        self.notified_at = Time.current
-        save!
-
-        case contact
-        when Email
-          ActorMailer.with(recovery: id).recover_credentials.deliver_later
-        end
-      end
-
-      def contact
-        return unless actor
-
-        @contact ||=
-          begin
-            contact =
-              if email
-                actor.emails.find_by(verified: true, email:)
-              elsif phone
-                # TODO
-              end
-
-            contact ||= actor.emails.where(verified: true).first
-            contact
-          end
-      end
-
-      def to_param
-        token
-      end
-
-      private
-
-      def generate_token
-        self.token ||= SecureRandom.hex(64)
-      end
-
-      def validates_actor
-        return if !actor || actor.valid?
-
-        actor.errors.full_messages.each { |error| errors.add(:base, error) }
-      end
-
-      def load_actor
-        return unless value
-
-        loaded =
-          self.actor = configuration.find_actor(session, email:, nickname:)
-
-        loaded.recoveries << self if loaded
-        loaded
-      end
-    end
-  end
-end

data/app/models/masks/rails/role.rb

@@ -1,20 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  module Rails
-    class Role < ApplicationRecord
-      include Masks::Role
-
-      self.table_name = "roles"
-
-      belongs_to :actor, polymorphic: true, autosave: true
-      belongs_to :record, polymorphic: true, autosave: true
-
-      validates :type,
-                presence: true,
-                uniqueness: {
-                  scope: %i[actor_id actor_type record_id record_type]
-                }
-    end
-  end
-end

data/app/models/masks/rails/scope.rb

@@ -1,15 +0,0 @@
-# frozen_string_literal: true
-
-module Masks
-  module Rails
-    class Scope < ApplicationRecord
-      self.table_name = "scopes"
-
-      validates :name, presence: true, uniqueness: { scope: :actor_id }
-
-      belongs_to :actor,
-                 polymorphic: true,
-                 class_name: Masks.configuration.models[:actor]
-    end
-  end
-end