masks 0.4.0 → 0.6.0

data/lib/masks/rails/credentials.rb

@@ -0,0 +1,60 @@
+module Masks
+  module Rails
+    # The default place a single-tenant app keeps what the handshake gives it,
+    # so `config.store` has something to be before a consumer writes one. An
+    # app with more than one issuer wants its own — `things` keeps these on
+    # `tenants`, because a handshake is per tenant there.
+    class Credentials
+      KEYS = %w[client_id client_secret registration_access_token registration_client_uri].freeze
+
+      attr_reader :path
+
+      def initialize(path)
+        @path = Pathname.new(path)
+        @lock = Mutex.new
+      end
+
+      def read
+        @lock.synchronize { held }
+      end
+
+      def write(registration)
+        @lock.synchronize do
+          @held = {
+            "client_id" => registration.client_id,
+            "client_secret" => registration.client_secret,
+            "registration_access_token" => registration.access_token,
+            "registration_client_uri" => registration.uri,
+            "connected_at" => Time.now.utc.iso8601
+          }.compact
+
+          path.dirname.mkpath
+          path.write(JSON.pretty_generate(@held))
+          path.chmod(0o600)
+          @held
+        end
+      end
+
+      def clear!
+        @lock.synchronize do
+          @held = nil
+          path.delete if path.exist?
+        end
+      end
+
+      def connected?
+        read["client_id"].present?
+      end
+
+      private
+
+        def held
+          return @held if defined?(@held) && @held
+
+          @held = path.exist? ? JSON.parse(path.read) : {}
+        rescue JSON::ParserError
+          @held = {}
+        end
+    end
+  end
+end

data/lib/masks/rails/engine.rb

@@ -0,0 +1,20 @@
+module Masks
+  module Rails
+    class Engine < ::Rails::Engine
+      isolate_namespace Masks::Rails
+
+      config.masks = Masks::Rails.config
+
+      # Opt-in, not blanket. This used to `include Masks::Rails::Authentication`
+      # into every controller in the host app, which lands twenty-five `masks_*`
+      # methods and four helper_methods on code the consumer owns, with no way
+      # to say no — and a name collision found that way is the kind of thing
+      # `grants:` versus `scope:` already cost this project once.
+      initializer "masks.authentication" do
+        ActiveSupport.on_load(:action_controller) do
+          include Masks::Rails::Authentication if Masks::Rails.config.authenticate_everything
+        end
+      end
+    end
+  end
+end

data/lib/masks/rails/protected_resource.rb

@@ -0,0 +1,51 @@
+module Masks
+  module Rails
+    module ProtectedResource
+      extend ActiveSupport::Concern
+      include Masks::Rails::Configurable
+
+      class_methods do
+        def masks_protect!(**options)
+          before_action(-> { masks_authenticate!(**options) }, **options.slice(:only, :except))
+        end
+      end
+
+      def masks_resource
+        @masks_resource ||= masks_config.resource_server_for(request)
+      end
+
+      def masks_claims
+        @masks_claims if defined?(@masks_claims)
+      end
+
+      def masks_authenticate!(scope: nil, **)
+        @masks_claims = masks_resource.authenticate(request.authorization, scope: scope)
+      rescue Masks::Client::Challenge => e
+        masks_challenge(e)
+        false
+      end
+
+      def masks_authenticate(scope: nil)
+        masks_resource.authenticate(request.authorization, scope: scope)
+      rescue Masks::Client::Unauthenticated
+        nil
+      end
+
+      def masks_challenge(error)
+        error = Masks::Client::Unauthorized.new(error.to_s) unless error.is_a?(Masks::Client::Challenge)
+
+        response.headers["WWW-Authenticate"] = masks_resource.challenge(error)
+        response.headers["Cache-Control"] = "no-store"
+
+        render json: {
+          "error" => error.code || "invalid_token",
+          "error_description" => error.description
+        }, status: error.status
+      end
+
+      def masks_resource_metadata
+        masks_resource.metadata
+      end
+    end
+  end
+end

data/lib/masks/rails.rb

@@ -0,0 +1,10 @@
+require "rails"
+
+require_relative "version"
+require_relative "client"
+require_relative "rails/credentials"
+require_relative "rails/configuration"
+require_relative "rails/configurable"
+require_relative "rails/authentication"
+require_relative "rails/protected_resource"
+require_relative "rails/engine"

data/lib/masks/version.rb

@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 module Masks
-  VERSION = Gem::Version.new("0.4.0")
+  VERSION = "0.6.0".freeze
 end

data/lib/masks.rb

@@ -1,184 +1,4 @@
-# frozen_string_literal: true
+require_relative "masks/version"
+require_relative "masks/client"
 
-require "masks/version"
-require "masks/engine"
-require "masks/configuration"
-require "fuzzyurl"
-require "valid_email"
-require "phonelib"
-require "rqrcode"
-require "rotp"
-require "alba"
-require "pagy"
-require "device_detector"
-require "active_model"
-require "chronic_duration"
-
-# Top-level module for masks.
-#
-# Includes helper methods for managing configuration and building
-# sessions, access, etc.
-module Masks
-  # @visibility private
-  ANON = :anon
-
-  class << self
-    # Returns an access instance based on the type & session passed.
-    #
-    # @param [Symbol|String] name
-    # @param [Masks::Session] session
-    # @return [Masks::Access]
-    # @raise [Masks::Error::Unauthorized] if access cannot be granted to the session passed
-    # @raise [Masks::UnknownAccess] if the access type cannot be found
-    def access(name, session, **_opts)
-      configuration.access(name).fetch(:cls).build(session)
-    end
-
-    # Returns a masked session based on the request passed.
-    #
-    # @param [ActionDispatch::Request] request
-    # @return [Masks::Sessions::Request] session
-    def request(request)
-      model = configuration.model(:request)
-      session = model.new(config: configuration, request:)
-      session.mask!
-      session
-    end
-
-    # Returns a masked session based on the params and data passed.
-    #
-    # This method is useful for creating masks directly, outside of a
-    # specific context like a web request.
-    #
-    # @param params [Hash]
-    # @param data [Hash]
-    # @yield [Masks::Sessions::Inline]
-    # @return [Masks::Sessions::Inline] session
-    def mask(name, params: {}, **data)
-      model = configuration.model(:inline)
-      session = model.new(name:, config: configuration, params:, data:)
-      session.mask!
-      yield session if session.passed? && block_given?
-      session
-    end
-
-    # Yields the global masks configuration object.
-    # @return [Masks::Configuration]
-    # @yield [Masks::Configuration]
-    def configure
-      yield configuration
-    end
-
-    # Returns the global configuration object for masks.
-    # @return [Masks::Configuration]
-    def configuration
-      @configuration ||= Masks::Configuration.new(data: config.dup)
-    end
-
-    # @visibility private
-    def event(name, **opts, &block)
-      ActiveSupport::Notifications.instrument("masks.#{name}", **opts) do
-        block.call
-      end
-    end
-
-    # @visibility private
-    def config
-      @config ||=
-        begin
-          config = load_config(config_path)
-
-          defaults =
-            if config[:extend]
-              # extend a "masks.json" from a gem
-              load_config(gem_path(config[:extend]))
-            else
-              {}
-            end
-
-          config = defaults.except(:masks).deep_merge(config)
-          config[:masks] = [*config[:masks], *defaults[:masks]] if defaults[
-            :masks
-          ]
-          config
-        end
-    end
-
-    # @visibility private
-    def with_config(path_or_config)
-      previous_config = @config
-      previous_path = @config_path
-
-      case path_or_config
-      when String
-        @config_path = Pathname.new(path_or_config)
-      when Pathname
-        @config_path = path_or_config
-      when Hash
-        @config_path = :custom
-        @config = path_or_config
-      else
-        raise Error::InvalidConfiguration, path_or_config
-      end
-
-      result = yield
-    ensure
-      @config = previous_config
-      @config_path = previous_path
-
-      result
-    end
-
-    # @visibility private
-    def config_path
-      path =
-        [
-          @config_path,
-          ENV["MASKS_DIR"] ? Pathname.new(ENV["MASKS_DIR"]) : nil,
-          Pathname.new(Dir.pwd),
-          defined?(ENGINE_ROOT) ? Pathname.new(ENGINE_ROOT) : nil
-        ].find do |p|
-          p.is_a?(Symbol) || (p && File.exist?(p.join("masks.json")))
-        end
-
-      raise Error::ConfigurationNotFound unless path
-
-      path
-    end
-
-    # @visibility private
-    def config_path=(value)
-      @config_path =
-        case value
-        when String
-          Pathname.new(value)
-        when Pathname
-          value
-        else
-          raise Error::InvalidConfiguration, value
-        end
-    end
-
-    # @visibility private
-    def reset!
-      @configuration = @config = @config_path = nil
-    end
-
-    def load_config(dir)
-      JSON.parse(File.read(dir.join("masks.json")), symbolize_names: true)
-    end
-
-    def gem_path(gem_name)
-      begin
-        # Try to require the gem
-        require gem_name
-      rescue LoadError
-        return nil
-      end
-
-      # Get the gem specification
-      spec = Gem::Specification.find_by_name(gem_name)
-      Pathname.new(spec.gem_dir) if spec
-    end
-  end
-end
+require_relative "masks/rails" if defined?(::Rails::Engine)