masks 0.4.0 → 0.6.0

data/lib/masks/client/tracker.rb

@@ -0,0 +1,122 @@
+module Masks
+  module Client
+    class Tracker
+      TTL = 3600
+      LIMIT = 5
+
+      class Entry
+        attr_reader :id, :data, :opened_at, :expires_at
+
+        def self.from_h(id, held)
+          return nil unless held.is_a?(Hash)
+
+          new(
+            id: id,
+            data: held["data"] || {},
+            opened_at: held["opened_at"].to_f,
+            expires_at: held["expires_at"].to_f
+          )
+        end
+
+        def initialize(id:, data:, opened_at:, expires_at:)
+          @id = id
+          @data = data
+          @opened_at = opened_at
+          @expires_at = expires_at
+        end
+
+        def live?(now = Time.now.to_f)
+          expires_at > now
+        end
+
+        def [](key)
+          data[key.to_s]
+        end
+
+        def to_h
+          { "data" => data, "opened_at" => opened_at, "expires_at" => expires_at }
+        end
+      end
+
+      attr_reader :store, :ttl, :limit
+
+      def initialize(store, ttl: TTL, limit: LIMIT)
+        @store = store
+        @ttl = ttl
+        @limit = limit
+      end
+
+      def open(**data)
+        id = SecureRandom.urlsafe_base64(32)
+        now = Time.now.to_f
+
+        entry = Entry.new(
+          id: id,
+          data: data.transform_keys(&:to_s).compact,
+          opened_at: now,
+          expires_at: now + ttl
+        )
+
+        write(sweep.merge(id => entry.to_h))
+        entry
+      end
+
+      def amend(id, **data)
+        held = sweep
+        entry = Entry.from_h(id, held[id])
+        return nil if entry.nil?
+
+        merged = Entry.new(
+          id: id,
+          data: entry.data.merge(data.transform_keys(&:to_s).compact),
+          opened_at: entry.opened_at,
+          expires_at: entry.expires_at
+        )
+
+        write(held.merge(id => merged.to_h))
+        merged
+      end
+
+      def claim(id)
+        return nil if id.nil? || id.empty?
+
+        held = sweep
+        entry = Entry.from_h(id, held[id])
+        return nil if entry.nil? || !entry.live?
+
+        write(held.except(id))
+        entry
+      end
+
+      def clear!
+        write({})
+      end
+
+      def size
+        sweep.size
+      end
+
+      private
+
+        def sweep
+          now = Time.now.to_f
+
+          held = read.select do |id, value|
+            entry = Entry.from_h(id, value)
+            entry&.live?(now)
+          end
+
+          held.to_a.last(limit).to_h
+        end
+
+        def read
+          value = store.read
+          value.is_a?(Hash) ? value : {}
+        end
+
+        def write(held)
+          store.write(held)
+        end
+    end
+  end
+end

data/lib/masks/client/verifier.rb

@@ -0,0 +1,42 @@
+module Masks
+  module Client
+    class Verifier
+      ALGORITHMS = %w[RS256 ES256].freeze
+
+      attr_reader :issuer, :audience
+
+      def initialize(issuer, audience:, algorithms: ALGORITHMS)
+        @issuer = Issuer.resolve(issuer)
+        @audience = Array(audience)
+        @algorithms = algorithms
+      end
+
+      def verify(token, required: %w[iss sub exp])
+        JWT.decode(
+          token, nil, true,
+          algorithms: @algorithms,
+          jwks: keys,
+          iss: issuer.url, verify_iss: true,
+          aud: audience, verify_aud: true,
+          verify_expiration: true,
+          required_claims: required
+        ).first
+      rescue JWT::DecodeError => e
+        raise InvalidToken, e.message
+      end
+
+      def tenant(token)
+        verify(token)["tenant"]
+      end
+
+      private
+
+        def keys
+          ->(options) do
+            issuer.refresh! if options[:invalidate]
+            issuer.jwks
+          end
+        end
+    end
+  end
+end

data/lib/masks/client.rb

@@ -0,0 +1,51 @@
+require "base64"
+require "json"
+require "jwt"
+require "net/http"
+require "openssl"
+require "securerandom"
+require "uri"
+
+require_relative "version"
+require_relative "client/errors"
+require_relative "client/http"
+require_relative "client/pkce"
+require_relative "client/stores"
+require_relative "client/tracker"
+require_relative "client/issuer"
+require_relative "client/registry"
+require_relative "client/tokens"
+require_relative "client/claims"
+require_relative "client/introspection"
+require_relative "client/session"
+require_relative "client/verifier"
+require_relative "client/resource"
+require_relative "client/rack"
+require_relative "client/registration"
+require_relative "client/handshake"
+
+module Masks
+  module Client
+    class << self
+      def registry
+        @registry ||= Registry.new
+      end
+
+      def issuer(url, **options)
+        Issuer.resolve(url, **options)
+      end
+
+      def verifier(url, audience:, **options)
+        Verifier.new(issuer(url), audience: audience, **options)
+      end
+
+      def resource(url, issuer:, **options)
+        Resource.new(issuer: issuer, url: url, **options)
+      end
+
+      def handshake(url, **options)
+        Handshake.new(url, **options)
+      end
+    end
+  end
+end

data/lib/masks/rails/authentication.rb

@@ -0,0 +1,260 @@
+module Masks
+  module Rails
+    module Authentication
+      extend ActiveSupport::Concern
+      include Masks::Rails::Configurable
+
+      included do
+        if respond_to?(:helper_method)
+          helper_method :masks_signed_in?, :masks_identity, :masks_tenant, :masks_scopes,
+                        :masks_claims
+        end
+      end
+
+      REQUESTS = "masks_requests".freeze
+      HANDSHAKES = "masks_handshakes".freeze
+
+      def masks_session
+        @masks_session ||= masks_config.session_for(request)
+      end
+
+      def masks_requests
+        @masks_requests ||= masks_tracker(REQUESTS)
+      end
+
+      def masks_handshakes
+        @masks_handshakes ||= masks_tracker(HANDSHAKES)
+      end
+
+      def masks_tracker(key)
+        Masks::Client::Tracker.new(Masks::Client::Stores::Session.new(session, key))
+      end
+
+      def masks_tokens
+        return @masks_tokens if defined?(@masks_tokens)
+
+        @masks_tokens = Masks::Client::Tokens.from_h(session[masks_config.session_key])
+      end
+
+      def masks_store(tokens, identity: nil)
+        held = tokens.to_h.except("id_token")
+        held["identity"] = identity&.slice(*IDENTITY) || masks_held["identity"]
+
+        session[masks_config.session_key] = held.compact
+        @masks_tokens = tokens
+        @masks_identity = held["identity"]
+      end
+
+      def masks_held
+        session[masks_config.session_key] || {}
+      end
+
+      IDENTITY = [
+        "sub", "name", "preferred_username", "email", "email_verified", "tenant",
+        "picture", Masks::Client::Claims::AVATARS
+      ].freeze
+
+      def masks_identity_from(tokens)
+        return nil if tokens.id_token.nil?
+
+        masks_session.identity(tokens)
+      end
+
+      def masks_forget
+        session.delete(masks_config.session_key)
+        @masks_tokens = nil
+        @masks_identity = nil
+      end
+
+      def masks_signed_in?
+        masks_tokens.present? && !masks_tokens.expired?
+      end
+
+      def masks_configured?
+        masks_config.configured?(request)
+      end
+
+      def masks_registration
+        Masks::Client::Registration.held(
+          masks_config.issuer_for(request),
+          masks_config.credentials_for(request)
+        )
+      end
+
+      def masks_registered?
+        held = masks_registration
+
+        held.nil? || held.known?
+      rescue Masks::Client::Error
+        true
+      end
+
+      def masks_disconnect!
+        return false unless masks_configured? && masks_config.can_forget?
+
+        masks_config.forget!(request)
+        masks_forget
+
+        true
+      end
+
+      def masks_reconnect!
+        return false if masks_registered?
+
+        masks_disconnect!
+      end
+
+      def masks_handshake_path
+        Masks::Rails::Engine.routes.url_helpers.handshake_path
+      end
+
+      def masks_identity
+        return @masks_identity if defined?(@masks_identity)
+
+        @masks_identity = masks_held["identity"]
+      end
+
+      def masks_tenant
+        masks_identity&.dig("tenant")
+      end
+
+      def masks_claims
+        @masks_claims ||= Masks::Client::Claims.new(masks_identity || {})
+      end
+
+      def masks_scopes
+        masks_tokens&.scopes || []
+      end
+
+      def masks_permits?(scope)
+        masks_scopes.include?(scope.to_s)
+      end
+
+      def masks_access_token
+        masks_tokens&.access_token
+      end
+
+      def masks_refresh!
+        return false unless masks_configured?
+        return false if masks_tokens&.refresh_token.nil?
+
+        masks_store(
+          masks_session.refresh(
+            masks_tokens.refresh_token,
+            resource: masks_config.resource_for(request)
+          )
+        )
+        true
+      rescue Masks::Client::Unregistered
+        masks_disconnect!
+        false
+      rescue Masks::Client::Rejected
+        masks_forget
+        false
+      end
+
+      def masks_logout_url(return_to: nil)
+        return nil unless masks_configured?
+
+        masks_session.end_session_url(
+          post_logout_redirect_uri: masks_post_logout_redirect_uri,
+          state: SecureRandom.urlsafe_base64(16)
+        )
+      rescue Masks::Client::Error
+        nil
+      end
+
+      def masks_post_logout_redirect_uri
+        "#{request.base_url}#{masks_local_path(masks_config.after_sign_out) || '/'}"
+      end
+
+      def masks_login_url(return_to: nil)
+        path = Masks::Rails::Engine.routes.url_helpers.start_path
+        target = masks_local_path(return_to)
+
+        target ? "#{path}?return_to=#{CGI.escape(target)}" : path
+      end
+
+      def masks_account
+        identity = masks_identity || {}
+
+        {
+          "signed_in" => masks_signed_in?,
+          "subject" => identity["sub"],
+          "name" => identity["name"],
+          "nickname" => identity["preferred_username"],
+          "email" => identity["email"],
+          "email_verified" => identity["email_verified"],
+          "picture" => masks_claims.picture,
+          "avatars" => masks_claims.avatars.to_h.presence,
+          "tenant" => masks_tenant,
+          "scopes" => masks_scopes,
+          "expires_at" => masks_tokens&.expires_at
+        }.compact
+      end
+
+      def authenticate_masks!
+        return true if masks_configured? && (masks_signed_in? || (masks_tokens && masks_refresh!))
+
+        masks_refuse
+        false
+      end
+
+      private
+
+        def masks_refuse
+          return masks_refuse_json if masks_wants_json?
+          return redirect_to(masks_handshake_path) unless masks_configured?
+
+          session[:masks_return_to] = request.fullpath if request.get?
+          redirect_to Masks::Rails::Engine.routes.url_helpers.start_path
+        end
+
+        def masks_refuse_json
+          response.headers["Cache-Control"] = "no-store"
+
+          render json: masks_refusal, status: :unauthorized
+        end
+
+        def masks_refusal
+          unless masks_configured?
+            return {
+              "signed_in" => false,
+              "error" => "handshake_required",
+              "handshake_url" => masks_handshake_path
+            }
+          end
+
+          {
+            "signed_in" => false,
+            "error" => "login_required",
+            "login_url" => masks_login_url(return_to: masks_referring_path)
+          }
+        end
+
+        def masks_wants_json?
+          request.xhr? ||
+            request.format.json? ||
+            request.content_mime_type&.symbol == :json ||
+            !request.format.html?
+        end
+
+        def masks_referring_path
+          return nil if request.referer.blank?
+
+          masks_local_path(URI.parse(request.referer).request_uri)
+        rescue URI::InvalidURIError
+          nil
+        end
+
+        def masks_local_path(value)
+          path = value.to_s
+
+          return nil unless path.start_with?("/")
+          return nil if path.start_with?("//", "/\\")
+
+          path
+        end
+    end
+  end
+end

data/lib/masks/rails/configurable.rb

@@ -0,0 +1,11 @@
+module Masks
+  module Rails
+    module Configurable
+      extend ActiveSupport::Concern
+
+      def masks_config
+        Masks::Rails.config
+      end
+    end
+  end
+end

data/lib/masks/rails/configuration.rb

@@ -0,0 +1,184 @@
+module Masks
+  module Rails
+    class Configuration
+      class Unconfigured < Masks::Client::Error; end
+
+      attr_accessor :scope, :namespace, :resource, :resource_scopes, :after_sign_in,
+                    :after_sign_out, :session_key, :sign_out_of_issuer, :parent_controller,
+                    :credentials_path, :authenticate_everything
+      attr_writer :issuer, :redirect_uri, :name, :credentials, :store, :forget
+
+      def initialize
+        @scope = Masks::Client::Session::DEFAULT_SCOPE
+        @resource_scopes = []
+        @after_sign_in = "/"
+        @after_sign_out = "/"
+        @session_key = "masks"
+        @sign_out_of_issuer = false
+        @parent_controller = "ActionController::Base"
+        @authenticate_everything = false
+      end
+
+      # An app that has not said where to keep its credentials gets one file
+      # under the Rails root, so the handshake works before anybody writes a
+      # `store` lambda. `things` overrides both because it is multi-tenant,
+      # which is the interesting case rather than the common one.
+      def default_credentials
+        @default_credentials ||= Credentials.new(
+          credentials_path || ::Rails.root.join("config", "masks.json")
+        )
+      end
+
+      def name_for(request)
+        resolve(@name, request).presence || ::Rails.application.class.module_parent_name
+      end
+
+      def issuer_for(request)
+        resolve(@issuer, request) ||
+          raise(Unconfigured, "Masks::Rails.config.issuer is not set")
+      end
+
+      def redirect_uri_for(request)
+        resolve(@redirect_uri, request) ||
+          "#{request.base_url}#{routes.callback_path}"
+      end
+
+      def resource_for(request)
+        resolve(@resource, request)
+      end
+
+      def credentials_for(request)
+        held = @credentials ? resolve(@credentials, request) : default_credentials.read
+        held ||= {}
+
+        held.respond_to?(:to_h) ? held.to_h.transform_keys(&:to_s) : {}
+      end
+
+      def client_id_for(request)
+        credentials_for(request)["client_id"].presence
+      end
+
+      def client_secret_for(request)
+        credentials_for(request)["client_secret"].presence
+      end
+
+      def configured?(request)
+        client_id_for(request).present?
+      end
+
+      # An app that keeps its own credentials has to say how to drop them, and
+      # until it does the engine does not offer a button it cannot honour.
+      def can_forget?
+        @forget.respond_to?(:call) || !@store.respond_to?(:call)
+      end
+
+      def forget!(request)
+        return @forget.call(request) if @forget.respond_to?(:call)
+        raise Unconfigured, "Masks::Rails.config.forget is not set" if @store.respond_to?(:call)
+
+        default_credentials.clear!
+      end
+
+      def store!(request, registration)
+        return default_credentials.write(registration) unless @store.respond_to?(:call)
+
+        @store.call(request, registration)
+      end
+
+      # The engine depends on `handshake_endpoint` being in the discovery
+      # document, and on the approval flow behind it. An issuer that predates
+      # both should say so here rather than at the one screen that exists to
+      # be the first thing anybody touches.
+      MINIMUM_ISSUER = 1
+
+      def issuer_speaks!(request)
+        spoken = Masks::Client::Issuer.resolve(issuer_for(request))
+                                     .discovery["masks_protocol_version"].to_i
+
+        return true if spoken >= MINIMUM_ISSUER
+
+        raise Unconfigured,
+              "#{issuer_for(request)} speaks masks protocol #{spoken}, and masks " \
+              "#{Masks::VERSION} needs at least #{MINIMUM_ISSUER}"
+      end
+
+      def session_for(request)
+        raise Unconfigured, "this app has not shaken hands with #{issuer_for(request)}" unless configured?(request)
+
+        Masks::Client::Session.new(
+          issuer: issuer_for(request),
+          client_id: client_id_for(request),
+          client_secret: client_secret_for(request),
+          redirect_uri: redirect_uri_for(request),
+          scope: scope
+        )
+      end
+
+      def resource_server_for(request)
+        url = Array(resource_for(request)).first
+
+        raise Unconfigured, "Masks::Rails.config.resource is not set" if url.nil?
+
+        Masks::Client::Resource.new(
+          issuer: issuer_for(request),
+          url: url,
+          scopes: resource_scopes
+        )
+      end
+
+      def handshake_for(request)
+        Masks::Client::Handshake.new(
+          issuer_for(request),
+          name: name_for(request),
+          resource: Array(resource_for(request)).first ||
+            raise(Unconfigured, "Masks::Rails.config.resource is not set"),
+          redirect_uris: [ redirect_uri_for(request) ],
+          return_to: return_to_for(request),
+          scope: approved_scope
+        )
+      end
+
+      # What the handshake asks to be approved for, which is not what a sign-in
+      # requests. An app that owns a namespace asks for the namespace once, so
+      # that adding a capability later is a deployment rather than an approval
+      # round; the authorize request still names the scopes it actually wants.
+      def approved_scope
+        return scope if namespace.blank?
+
+        outside = Array(scope).reject { |name| name.to_s.start_with?(namespace) }
+
+        outside + [ namespace ]
+      end
+
+      def return_to_for(request)
+        uri = URI.parse(redirect_uri_for(request))
+        port = ":#{uri.port}" unless uri.port == uri.default_port
+
+        "#{uri.scheme}://#{uri.host}#{port}#{routes.handshake_callback_path}"
+      end
+
+      private
+
+        def routes
+          Masks::Rails::Engine.routes.url_helpers
+        end
+
+        def resolve(value, request)
+          return value unless value.respond_to?(:call)
+
+          value.arity.zero? ? value.call : value.call(request)
+        end
+    end
+
+    class << self
+      def config
+        @config ||= Configuration.new
+      end
+
+      def configure
+        yield config
+        config
+      end
+    end
+  end
+end