masks 0.7.0 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5da19b0cb3099ebe46f2b4509615a75422fa0b2820abb799e8f182ce11f456ad
-  data.tar.gz: 4d5d6b573cccbca63439587cd3363d22be28dd0d8ff95051f32dcc8252494185
+  metadata.gz: 3ec26aa454cf249dd26ce7e15444b43890e4e75954968c76cba3297b63f9819e
+  data.tar.gz: 19609ef3a180ab7d6c675cac13cef843adb3ffc742d83b7fd64d7120bbcc93b5
 SHA512:
-  metadata.gz: 130ccd4e8a1ca7ddfe996f7439af4dc800501ea0a81ec0a18561475447931af40affb0cd0e2a66aa191d28d93f677046f49b7d5db6a913426fa21114d1bcbb68
-  data.tar.gz: bd818590edc19a344daf59e755d8657da71e10f2017fc3b8ffe95ed6f8452f804a6ccdc7da621425b288c5934b25b5c39bd41923d13983e16fab9ab144bdfd78
+  metadata.gz: 4a02a532dc018b73c27b350da38335b5ec27c5665d8b498564fd11b220e386919df8ecc9a24b80fb62f21d193c7a66166e99d2dc41c86fef3cb515f5aacc2b0d
+  data.tar.gz: fbbb524a91dda55fc6ccf631d1ef8b270b9ff9835b894855dcd0dd07a054fcfb380c6fdea75930b93950909ba1e3618940215418c9fca7f0a5f32e30b33c96b4

data/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## [0.8.0](https://github.com/masksrb/masks/compare/gem/v0.7.0...gem/v0.8.0) (2026-09-28)
+
+
+### ⚠ BREAKING CHANGES
+
+* a resource server on an older gem still accepts the new tokens, but this gem refuses access tokens from a server that does not type them.
+
+### Features
+
+* an access token is typed at+jwt, and nothing takes a token of another type in its place ([d0b4cfd](https://github.com/masksrb/masks/commit/d0b4cfdf802053359695495d417225e3a1578302))
+* **client:** a Rails app lists the organizations a person belongs to and links them to another ([7f0d223](https://github.com/masksrb/masks/commit/7f0d2237799e04551d2c403de695c704e5455db8))
+* **client:** a Rails app names the organization a person signs in to, reads their role, and keeps pages and APIs to members in a role ([579cecc](https://github.com/masksrb/masks/commit/579ceccac1c0137dfa1ed7a3894dea61e5cdd67e))
+* **client:** a session signs its own client assertions, and asks for a token of its own ([614248b](https://github.com/masksrb/masks/commit/614248b70a3ee517fbd3c1f7151b66ec6406b487))
+* **client:** an exchange hands over an ID token or an actor token ([6b67766](https://github.com/masksrb/masks/commit/6b67766ce275b9578d575349256638adddd5a599))
+* **client:** the session says where the person manages their account, as account_url ([1d36e1d](https://github.com/masksrb/masks/commit/1d36e1d4daa8c5acfc9133a1896aa9384771dbd6))
+
+
+### Documentation
+
+* Rails apps covers client, server, and engine mode ([41454a2](https://github.com/masksrb/masks/commit/41454a242438e4df246dcbc4dce94b6d8a022239))
+
+
+### Refactoring
+
+* **client:** an organization key is checked in one place, and a refresh renews the whole identity from userinfo ([b349aae](https://github.com/masksrb/masks/commit/b349aaec4dd5c9790c72dd1dc8f91016a2adceea))
+
 ## [0.7.0](https://github.com/masksrb/masks/compare/gem/v0.6.0...gem/v0.7.0) (2026-09-13)
 
 

data/README.md

@@ -1,4 +1,4 @@
-<p align="center"><img src="https://raw.githubusercontent.com/masksrb/masks/main/server/public/icon.svg" width="120" alt="The masks rose window"></p>
+<p align="center"><img src="https://raw.githubusercontent.com/masksrb/masks/main/engine/public/masks-public/icon.svg" width="120" alt="The masks rose window"></p>
 
 # masks
 
@@ -108,6 +108,51 @@ end
 `resource_metadata`, so a client handed nothing but a URL can find its way to the issuer
 and back.
 
+### Organizations
+
+A person signs in to an app as a member of one organization when the app asks for the
+`organization` scope. Someone in several organizations picks one, and an app can pick for them by
+naming it: `/auth?organization=acme`, or `config.organization` for every sign-in.
+
+```ruby
+Masks::Rails.configure do |config|
+  config.scope = %w[openid profile email offline_access organization]
+  config.organization = ->(request) { request.subdomain }
+end
+
+class BillingController < ApplicationController
+  include Masks::Rails::Authentication
+
+  masks_members_only! role: %w[owner billing]
+end
+```
+
+`masks_organization` is the organization signed in to (its `id`, `key`, `name`, and `role`), or
+`nil`, and `masks_role?("owner")` asks about the role held in it. A refresh reads the person's
+profile again, so a promotion or demotion reaches the app within an access token's lifetime.
+`/auth/session` answers the same thing as `organization`.
+
+`masks_organizations` lists every organization the person has joined, each with the role held in
+it, and `/auth/session` answers it as `organizations`. Switching sends the person through sign-in
+again naming the other one, which asks nothing more when they are already a member:
+
+```erb
+<% masks_organizations.each do |held| %>
+  <%= link_to held.name, masks_login_url(organization: held.key, return_to: request.path) %>
+<% end %>
+```
+
+`masks_members_only!` refuses with 403, as `insufficient_organization` when the person signed
+in to none and `insufficient_role` when they hold another role. A resource server asks the same of a
+token:
+
+```ruby
+masks_protect! scope: "uris:catalog:write", role: "owner", organization: "acme"
+```
+
+Naming an organization without asking for the scope still holds the sign-in to its members and its
+sign-in policy; the app just learns nothing about the role.
+
 ### Avatars
 
 Every actor has three faces at once — an uploaded `photo`, an `identicon`, and two-letter
@@ -146,6 +191,7 @@ a subdomain-per-tenant host needs.
 | `resource` | this app's own identifier, when it also accepts tokens |
 | `resource_scopes` | what it accepts, published in its RFC 9728 metadata |
 | `scope` | what to ask the issuer for; defaults to `openid profile email` |
+| `organization` | the organization every sign-in names, by key |
 | `credentials` / `store` | where the handshake's result lives |
 | `credentials_path` | where the default store writes; `config/masks.json` |
 | `after_sign_in` / `after_sign_out` | paths on this host |

data/app/controllers/masks/rails/sessions_controller.rb

@@ -21,7 +21,9 @@ module Masks
         )
         started = masks_session.start(
           state: pending.id,
-          resource: masks_config.resource_for(request)
+          resource: masks_config.resource_for(request),
+          organization: Masks::Client::Session.organization_key(params[:organization]) ||
+            masks_config.organization_for(request)
         )
 
         masks_requests.amend(

data/lib/masks/client/claims.rb

@@ -60,7 +60,51 @@ module Masks
         end
       end
 
+      class Organization
+        OWNER = "owner".freeze
+
+        attr_reader :to_h
+
+        def initialize(hash)
+          @to_h = hash.is_a?(Hash) ? hash.transform_keys(&:to_s) : {}
+        end
+
+        def id
+          to_h["id"]
+        end
+
+        def key
+          to_h["key"]
+        end
+
+        def name
+          to_h["name"]
+        end
+
+        def role
+          to_h["role"]
+        end
+
+        def role?(*roles)
+          roles.flatten.map(&:to_s).include?(role)
+        end
+
+        def owner?
+          role?(OWNER)
+        end
+
+        def present?
+          !id.nil? && !key.nil? && !role.nil?
+        end
+
+        def ==(other)
+          other.is_a?(Organization) ? to_h == other.to_h : false
+        end
+      end
+
       AVATARS = "masks:avatars".freeze
+      ORGANIZATION = "org".freeze
+      ORGANIZATIONS = "orgs".freeze
 
       attr_reader :to_h
 
@@ -104,6 +148,31 @@ module Masks
         @avatars ||= Avatars.new(self[AVATARS])
       end
 
+      def organization
+        @organization ||= Organization.new(self[ORGANIZATION])
+      end
+
+      def organizations
+        @organizations ||= Array(self[ORGANIZATIONS]).map { |held| Organization.new(held) }.select(&:present?).freeze
+      end
+
+      def member!(*roles, organization: nil)
+        held = self.organization
+
+        unless held.present?
+          raise Forbidden.new("insufficient_organization", "this token names no organization",
+                              scope: Session::ORGANIZATION)
+        end
+
+        if organization && held.key != organization.to_s && held.id != organization.to_s
+          raise Forbidden.new("insufficient_organization", "this token was issued for #{held.key}, not #{organization}")
+        end
+
+        return held if roles.flatten.empty? || held.role?(*roles)
+
+        raise Forbidden.new("insufficient_role", "#{held.role} in #{held.key} is not #{roles.flatten.join(' or ')}")
+      end
+
       def picture
         self["picture"] || avatars.photo || avatars.identicon
       end

data/lib/masks/client/introspection.rb

@@ -24,6 +24,12 @@ module Masks
 
         super
       end
+
+      def member!(*roles, organization: nil)
+        raise Unauthorized.new("the issuer reports this token is not active") unless active?
+
+        super
+      end
     end
   end
 end

data/lib/masks/client/logout.rb

@@ -9,7 +9,7 @@ module Masks
         def verify(token, issuer:, audience:, algorithms: ALGORITHMS)
           held = Verifier
             .new(issuer, audience: audience, algorithms: algorithms)
-            .verify(token, required: %w[iss aud iat jti events])
+            .verify(token, required: %w[iss aud iat jti events], typ: Verifier::LOGOUT_TOKEN)
 
           new(held).validate!
         end

data/lib/masks/client/resource.rb

@@ -18,10 +18,11 @@ module Masks
         @verifier = verifier || Verifier.new(@issuer, audience: @url, algorithms: algorithms)
       end
 
-      def authenticate(authorization, scope: nil)
-        claims = Claims.new(@verifier.verify(token!(authorization), required: @required))
+      def authenticate(authorization, scope: nil, role: nil, organization: nil)
+        claims = Claims.new(@verifier.verify(token!(authorization), required: @required, typ: Verifier::ACCESS_TOKEN))
 
         Array(scope).each { |name| claims.permit!(name) }
+        claims.member!(*Array(role), organization: organization) if role || organization
 
         claims
       rescue InvalidToken => e

data/lib/masks/client/session.rb

@@ -2,21 +2,37 @@ module Masks
   module Client
     class Session
       DEFAULT_SCOPE = %w[openid profile email].freeze
+      ORGANIZATION = "organization".freeze
+      ORGANIZATION_KEY = /\A[a-z0-9][a-z0-9-]*\z/
 
-      attr_reader :issuer, :client_id, :client_secret, :redirect_uri, :scope
+      def self.organization_key(value)
+        key = value.to_s.strip.downcase
+
+        key.match?(ORGANIZATION_KEY) ? key : nil
+      end
+      ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer".freeze
+      ASSERTION_LIFETIME = 60
+
+      attr_reader :issuer, :client_id, :client_secret, :redirect_uri, :scope, :private_key, :key_id
+
+      def initialize(issuer:, client_id:, redirect_uri: nil, client_secret: nil, private_key: nil, key_id: nil,
+                     scope: DEFAULT_SCOPE)
+        raise ArgumentError, "a client authenticates with a secret or a private key, not both" if client_secret && private_key
 
-      def initialize(issuer:, client_id:, redirect_uri:, client_secret: nil, scope: DEFAULT_SCOPE)
         @issuer = Issuer.resolve(issuer)
         @client_id = client_id
         @client_secret = client_secret
+        @private_key = private_key.is_a?(String) ? OpenSSL::PKey.read(private_key) : private_key
+        @key_id = key_id
         @redirect_uri = redirect_uri
         @scope = Array(scope)
       end
 
       def start(resource: nil, prompt: nil, scope: nil, state: SecureRandom.urlsafe_base64(24),
-                nonce: SecureRandom.urlsafe_base64(24), max_age: nil)
+                nonce: SecureRandom.urlsafe_base64(24), max_age: nil, organization: nil)
         pkce = Pkce.generate
         scopes = Array(scope || self.scope)
+        organization = Session.organization_key(organization)
         nonce = nil unless scopes.include?("openid")
 
         pairs = [
@@ -34,6 +50,7 @@ module Masks
         Array(resource).each { |value| pairs << [ "resource", value ] }
         pairs << [ "prompt", prompt ] if prompt
         pairs << [ "max_age", max_age.to_i ] if max_age
+        pairs << [ "organization", organization ] if organization
 
         {
           url: "#{issuer.endpoint('authorization_endpoint')}?#{URI.encode_www_form(pairs)}",
@@ -54,7 +71,16 @@ module Masks
 
         Array(resource).each { |value| form << [ "resource", value ] }
 
-        Tokens.granted(HTTP.post_form(issuer.endpoint("token_endpoint"), form, authorization))
+        Tokens.granted(post("token_endpoint", form))
+      end
+
+      def client_credentials(scope: nil, resource: nil)
+        form = [ [ "grant_type", "client_credentials" ], [ "client_id", client_id ] ]
+
+        form << [ "scope", Array(scope).join(" ") ] if scope
+        Array(resource).each { |value| form << [ "resource", value ] }
+
+        Tokens.granted(post("token_endpoint", form))
       end
 
       def refresh(refresh_token, resource: nil, scope: nil)
@@ -67,17 +93,20 @@ module Masks
         form << [ "scope", Array(scope).join(" ") ] if scope
         Array(resource).each { |value| form << [ "resource", value ] }
 
-        Tokens.granted(HTTP.post_form(issuer.endpoint("token_endpoint"), form, authorization))
+        Tokens.granted(post("token_endpoint", form))
       end
 
-      def exchange(subject_token, scope: nil, resource: nil, lifetime: nil, requested_token_type: nil, audience: nil)
+      def exchange(subject_token, scope: nil, resource: nil, lifetime: nil, requested_token_type: nil, audience: nil,
+                   subject_token_type: Tokens::ACCESS_TOKEN, actor_token: nil, actor_token_type: Tokens::ACCESS_TOKEN)
         form = [
           [ "grant_type", Tokens::EXCHANGE ],
           [ "client_id", client_id ],
           [ "subject_token", subject_token ],
-          [ "subject_token_type", Tokens::ACCESS_TOKEN ]
+          [ "subject_token_type", subject_token_type ]
         ]
 
+        form.push([ "actor_token", actor_token ], [ "actor_token_type", actor_token_type ]) if actor_token
+
         form << [ "requested_token_type", requested_token_type ] if requested_token_type
         Array(audience).each { |value| form << [ "audience", value ] }
 
@@ -85,14 +114,14 @@ module Masks
         form << [ "requested_lifetime", lifetime.to_i ] if lifetime
         Array(resource).each { |value| form << [ "resource", value ] }
 
-        Tokens.granted(HTTP.post_form(issuer.endpoint("token_endpoint"), form, authorization))
+        Tokens.granted(post("token_endpoint", form))
       end
 
       def revoke(token, hint: nil)
         form = [ [ "token", token ], [ "client_id", client_id ] ]
         form << [ "token_type_hint", hint ] if hint
 
-        HTTP.post_form(issuer.endpoint("revocation_endpoint"), form, authorization)
+        post("revocation_endpoint", form)
         true
       end
 
@@ -114,7 +143,7 @@ module Masks
         form << [ "token_type_hint", hint ] if hint
 
         Introspection.new(
-          HTTP.post_form(issuer.endpoint("introspection_endpoint"), form, authorization)
+          post("introspection_endpoint", form)
         )
       end
 
@@ -140,6 +169,36 @@ module Masks
 
       private
 
+        def post(endpoint, form)
+          url = issuer.endpoint(endpoint)
+
+          HTTP.post_form(url, form + assertion, authorization)
+        end
+
+        def assertion
+          return [] if private_key.nil?
+
+          now = Time.now.to_i
+          claims = {
+            "iss" => client_id, "sub" => client_id, "aud" => issuer.url,
+            "iat" => now, "exp" => now + ASSERTION_LIFETIME, "jti" => SecureRandom.uuid
+          }
+          header = key_id ? { kid: key_id } : {}
+
+          [
+            [ "client_assertion_type", ASSERTION_TYPE ],
+            [ "client_assertion", JWT.encode(claims, private_key, signing_algorithm, header) ]
+          ]
+        end
+
+        def signing_algorithm
+          return "RS256" if private_key.is_a?(OpenSSL::PKey::RSA)
+
+          { "prime256v1" => "ES256", "secp384r1" => "ES384", "secp521r1" => "ES512" }.fetch(private_key.group.curve_name) do
+            raise ArgumentError, "#{private_key.group.curve_name} is not a curve masks checks assertions for"
+          end
+        end
+
         def authorization
           return {} if client_secret.nil?
 

data/lib/masks/client/tokens.rb

@@ -3,6 +3,7 @@ module Masks
     class Tokens
       EXCHANGE = "urn:ietf:params:oauth:grant-type:token-exchange".freeze
       ACCESS_TOKEN = "urn:ietf:params:oauth:token-type:access_token".freeze
+      ID_TOKEN = "urn:ietf:params:oauth:token-type:id_token".freeze
 
       attr_reader :access_token, :id_token, :refresh_token, :token_type, :scope, :expires_in, :obtained_at,
                   :delegations

data/lib/masks/client/verifier.rb

@@ -2,6 +2,9 @@ module Masks
   module Client
     class Verifier
       ALGORITHMS = %w[RS256 ES256].freeze
+      ACCESS_TOKEN = "at+jwt".freeze
+      LOGOUT_TOKEN = "logout+jwt".freeze
+      ID_TOKEN = [ "jwt", nil ].freeze
 
       attr_reader :issuer, :audience
 
@@ -11,8 +14,8 @@ module Masks
         @algorithms = algorithms
       end
 
-      def verify(token, required: %w[iss sub exp])
-        JWT.decode(
+      def verify(token, required: %w[iss sub exp], typ: ID_TOKEN)
+        claims, header = JWT.decode(
           token, nil, true,
           algorithms: @algorithms,
           jwks: keys,
@@ -20,7 +23,11 @@ module Masks
           aud: audience, verify_aud: true,
           verify_expiration: true,
           required_claims: required
-        ).first
+        )
+
+        typed!(header["typ"], Array(typ))
+
+        claims
       rescue JWT::DecodeError => e
         raise InvalidToken, e.message
       end
@@ -31,6 +38,14 @@ module Masks
 
       private
 
+        def typed!(held, accepted)
+          named = held&.to_s&.downcase&.delete_prefix("application/")
+
+          return if accepted.include?(named)
+
+          raise InvalidToken, "that token is typed #{held.inspect}, not #{accepted.compact.join(' or ')}"
+        end
+
         def keys
           ->(options) do
             issuer.refresh! if options[:invalidate]

data/lib/masks/rails/authentication.rb

@@ -7,7 +7,15 @@ module Masks
       included do
         if respond_to?(:helper_method)
           helper_method :masks_signed_in?, :masks_identity, :masks_tenant, :masks_scopes,
-                        :masks_claims
+                        :masks_claims, :masks_organization, :masks_organizations, :masks_role?,
+                        :masks_login_url
+        end
+      end
+
+      class_methods do
+        def masks_members_only!(role: nil, organization: nil, **options)
+          before_action(-> { authorize_masks_member!(*Array(role), organization: organization) },
+                        **options.slice(:only, :except))
         end
       end
 
@@ -43,6 +51,7 @@ module Masks
         session[masks_config.session_key] = held.compact
         @masks_tokens = tokens
         @masks_identity = held["identity"]
+        @masks_claims = nil
       end
 
       def masks_held
@@ -51,7 +60,8 @@ module Masks
 
       IDENTITY = [
         "sub", "name", "preferred_username", "email", "email_verified", "tenant",
-        "picture", Masks::Client::Claims::AVATARS
+        "picture", Masks::Client::Claims::AVATARS, Masks::Client::Claims::ORGANIZATION,
+        Masks::Client::Claims::ORGANIZATIONS
       ].freeze
 
       def masks_identity_from(tokens)
@@ -64,6 +74,7 @@ module Masks
         session.delete(masks_config.session_key)
         @masks_tokens = nil
         @masks_identity = nil
+        @masks_claims = nil
       end
 
       def masks_signed_in?
@@ -122,6 +133,20 @@ module Masks
         @masks_claims ||= Masks::Client::Claims.new(masks_identity || {})
       end
 
+      def masks_organization
+        held = masks_claims.organization
+
+        held.present? ? held : nil
+      end
+
+      def masks_organizations
+        masks_claims.organizations
+      end
+
+      def masks_role?(*roles)
+        masks_organization&.role?(*roles) || false
+      end
+
       def masks_scopes
         masks_tokens&.scopes || []
       end
@@ -138,12 +163,12 @@ module Masks
         return false unless masks_configured?
         return false if masks_tokens&.refresh_token.nil?
 
-        masks_store(
-          masks_session.refresh(
-            masks_tokens.refresh_token,
-            resource: masks_config.resource_for(request)
-          )
+        refreshed = masks_session.refresh(
+          masks_tokens.refresh_token,
+          resource: masks_config.resource_for(request)
         )
+
+        masks_store(refreshed, identity: masks_refreshed_identity(refreshed))
         true
       rescue Masks::Client::Unregistered
         masks_disconnect!
@@ -153,6 +178,16 @@ module Masks
         false
       end
 
+      def masks_refreshed_identity(tokens)
+        held = masks_held["identity"]
+
+        return nil unless held.is_a?(Hash)
+
+        profile = masks_session.profile(tokens)
+
+        profile.empty? ? nil : held.merge(profile.slice(*IDENTITY))
+      end
+
       def masks_logout_url(return_to: nil)
         return nil unless masks_configured?
 
@@ -168,11 +203,14 @@ module Masks
         "#{request.base_url}#{masks_local_path(masks_config.after_sign_out) || '/'}"
       end
 
-      def masks_login_url(return_to: nil)
+      def masks_login_url(return_to: nil, organization: nil)
         path = Masks::Rails::Engine.routes.url_helpers.start_path
-        target = masks_local_path(return_to)
+        query = {
+          "return_to" => masks_local_path(return_to),
+          "organization" => Masks::Client::Session.organization_key(organization)
+        }.compact
 
-        target ? "#{path}?return_to=#{CGI.escape(target)}" : path
+        query.empty? ? path : "#{path}?#{URI.encode_www_form(query)}"
       end
 
       def masks_account
@@ -188,11 +226,20 @@ module Masks
           "picture" => masks_claims.picture,
           "avatars" => masks_claims.avatars.to_h.presence,
           "tenant" => masks_tenant,
+          "organization" => masks_organization&.to_h,
+          "organizations" => masks_organizations.map(&:to_h).presence,
           "scopes" => masks_scopes,
-          "expires_at" => masks_tokens&.expires_at
+          "expires_at" => masks_tokens&.expires_at,
+          "account_url" => masks_account_url
         }.compact
       end
 
+      def masks_account_url
+        "#{masks_config.issuer_for(request).to_s.chomp('/')}/"
+      rescue Masks::Rails::Configuration::Unconfigured
+        nil
+      end
+
       def authenticate_masks!
         return true if masks_configured? && (masks_signed_in? || (masks_tokens && masks_refresh!))
 
@@ -200,8 +247,28 @@ module Masks
         false
       end
 
+      def authorize_masks_member!(*roles, organization: nil)
+        return false unless authenticate_masks!
+
+        masks_claims.member!(*roles, organization: organization)
+        true
+      rescue Masks::Client::Forbidden => e
+        masks_forbid(e)
+        false
+      end
+
       private
 
+        def masks_forbid(error)
+          response.headers["Cache-Control"] = "no-store"
+
+          if masks_wants_json?
+            render json: { "error" => error.code, "error_description" => error.description }, status: :forbidden
+          else
+            render plain: error.description, status: :forbidden
+          end
+        end
+
         def masks_refuse
           return masks_refuse_json if masks_wants_json?
           return redirect_to(masks_handshake_path) unless masks_configured?

data/lib/masks/rails/configuration.rb

@@ -7,7 +7,7 @@ module Masks
                     :after_sign_out, :session_key, :sign_out_of_issuer, :parent_controller,
                     :credentials_path, :authenticate_everything, :delegates
       attr_writer :issuer, :redirect_uri, :name, :credentials, :store, :forget, :logged_out,
-                  :delegation_redirect_uri
+                  :delegation_redirect_uri, :organization
 
       def initialize
         @scope = Masks::Client::Session::DEFAULT_SCOPE
@@ -51,6 +51,10 @@ module Masks
         resolve(@resource, request)
       end
 
+      def organization_for(request)
+        resolve(@organization, request)
+      end
+
       def credentials_for(request)
         held = @credentials ? resolve(@credentials, request) : default_credentials.read
         held ||= {}

data/lib/masks/rails/protected_resource.rb

@@ -18,15 +18,16 @@ module Masks
         @masks_claims if defined?(@masks_claims)
       end
 
-      def masks_authenticate!(scope: nil, **)
-        @masks_claims = masks_resource.authenticate(request.authorization, scope: scope)
+      def masks_authenticate!(scope: nil, role: nil, organization: nil, **)
+        @masks_claims = masks_resource.authenticate(request.authorization, scope: scope, role: role,
+                                                                           organization: organization)
       rescue Masks::Client::Challenge => e
         masks_challenge(e)
         false
       end
 
-      def masks_authenticate(scope: nil)
-        masks_resource.authenticate(request.authorization, scope: scope)
+      def masks_authenticate(scope: nil, role: nil, organization: nil)
+        masks_resource.authenticate(request.authorization, scope: scope, role: role, organization: organization)
       rescue Masks::Client::Unauthenticated
         nil
       end

data/lib/masks/rails.rb

@@ -20,8 +20,8 @@ module Masks
   # [ProtectedResource] the other direction — checking a bearer this app was
   #                    handed, for an API rather than a browser
   #
-  # This engine is the client. It never runs in the same process as the
-  # provider, which is a standalone deployable holding its own database.
+  # This engine is the client. The provider is the masks-server gem, whether
+  # it runs elsewhere or is mounted on a subdomain of this app.
   module Rails
   end
 end

data/lib/masks/version.rb

@@ -1,3 +1,3 @@
 module Masks
-  VERSION = "0.7.0".freeze
+  VERSION = "0.8.0".freeze
 end

data/lib/masks.rb

@@ -10,8 +10,8 @@
 #   issuer = Masks::Client.issuer("https://auth.example")
 #   issuer.authorization_url(client_id: id, redirect_uri: uri)
 #
-# The provider itself is not in here. It is a deployable that holds a database
-# and the per-tenant signing keys, and it stays standalone.
+# The provider itself is not in here. It is the masks-server gem, which runs
+# as an app of its own or mounted inside another Rails app.
 module Masks
 end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: masks
 version: !ruby/object:Gem::Version
-  version: 0.7.0
+  version: 0.8.0
 platform: ruby
 authors:
 - the masks authors
@@ -25,7 +25,8 @@ dependencies:
         version: '3.1'
 description: Discovery, PKCE authorization, token exchange, and token verification
   against a masks issuer, with Rack middleware for a resource server and a Rails engine
-  that mounts the consumer half of the code flow. The auth server itself stays standalone.
+  that mounts the consumer half of the code flow. The auth server itself is the masks-server
+  gem.
 executables: []
 extensions: []
 extra_rdoc_files: []