masks 0.7.0 → 0.9.1

data/lib/masks/rails/authentication.rb

@@ -7,7 +7,15 @@ module Masks
       included do
         if respond_to?(:helper_method)
           helper_method :masks_signed_in?, :masks_identity, :masks_tenant, :masks_scopes,
-                        :masks_claims
+                        :masks_claims, :masks_organization, :masks_organizations, :masks_role?,
+                        :masks_login_url
+        end
+      end
+
+      class_methods do
+        def masks_members_only!(role: nil, organization: nil, **options)
+          before_action(-> { authorize_masks_member!(*Array(role), organization: organization) },
+                        **options.slice(:only, :except))
         end
       end
 
@@ -43,6 +51,7 @@ module Masks
         session[masks_config.session_key] = held.compact
         @masks_tokens = tokens
         @masks_identity = held["identity"]
+        @masks_claims = nil
       end
 
       def masks_held
@@ -51,7 +60,8 @@ module Masks
 
       IDENTITY = [
         "sub", "name", "preferred_username", "email", "email_verified", "tenant",
-        "picture", Masks::Client::Claims::AVATARS
+        "picture", Masks::Client::Claims::AVATARS, Masks::Client::Claims::ORGANIZATION,
+        Masks::Client::Claims::ORGANIZATIONS
       ].freeze
 
       def masks_identity_from(tokens)
@@ -64,6 +74,7 @@ module Masks
         session.delete(masks_config.session_key)
         @masks_tokens = nil
         @masks_identity = nil
+        @masks_claims = nil
       end
 
       def masks_signed_in?
@@ -122,6 +133,20 @@ module Masks
         @masks_claims ||= Masks::Client::Claims.new(masks_identity || {})
       end
 
+      def masks_organization
+        held = masks_claims.organization
+
+        held.present? ? held : nil
+      end
+
+      def masks_organizations
+        masks_claims.organizations
+      end
+
+      def masks_role?(*roles)
+        masks_organization&.role?(*roles) || false
+      end
+
       def masks_scopes
         masks_tokens&.scopes || []
       end
@@ -138,12 +163,12 @@ module Masks
         return false unless masks_configured?
         return false if masks_tokens&.refresh_token.nil?
 
-        masks_store(
-          masks_session.refresh(
-            masks_tokens.refresh_token,
-            resource: masks_config.resource_for(request)
-          )
+        refreshed = masks_session.refresh(
+          masks_tokens.refresh_token,
+          resource: masks_config.resource_for(request)
         )
+
+        masks_store(refreshed, identity: masks_refreshed_identity(refreshed))
         true
       rescue Masks::Client::Unregistered
         masks_disconnect!
@@ -153,6 +178,16 @@ module Masks
         false
       end
 
+      def masks_refreshed_identity(tokens)
+        held = masks_held["identity"]
+
+        return nil unless held.is_a?(Hash)
+
+        profile = masks_session.profile(tokens)
+
+        profile.empty? ? nil : held.merge(profile.slice(*IDENTITY))
+      end
+
       def masks_logout_url(return_to: nil)
         return nil unless masks_configured?
 
@@ -168,11 +203,14 @@ module Masks
         "#{request.base_url}#{masks_local_path(masks_config.after_sign_out) || '/'}"
       end
 
-      def masks_login_url(return_to: nil)
+      def masks_login_url(return_to: nil, organization: nil)
         path = Masks::Rails::Engine.routes.url_helpers.start_path
-        target = masks_local_path(return_to)
+        query = {
+          "return_to" => masks_local_path(return_to),
+          "organization" => Masks::Client::Session.organization_key(organization)
+        }.compact
 
-        target ? "#{path}?return_to=#{CGI.escape(target)}" : path
+        query.empty? ? path : "#{path}?#{URI.encode_www_form(query)}"
       end
 
       def masks_account
@@ -188,11 +226,20 @@ module Masks
           "picture" => masks_claims.picture,
           "avatars" => masks_claims.avatars.to_h.presence,
           "tenant" => masks_tenant,
+          "organization" => masks_organization&.to_h,
+          "organizations" => masks_organizations.map(&:to_h).presence,
           "scopes" => masks_scopes,
-          "expires_at" => masks_tokens&.expires_at
+          "expires_at" => masks_tokens&.expires_at,
+          "account_url" => masks_account_url
         }.compact
       end
 
+      def masks_account_url
+        "#{masks_config.issuer_for(request).to_s.chomp('/')}/"
+      rescue Masks::Rails::Configuration::Unconfigured
+        nil
+      end
+
       def authenticate_masks!
         return true if masks_configured? && (masks_signed_in? || (masks_tokens && masks_refresh!))
 
@@ -200,8 +247,28 @@ module Masks
         false
       end
 
+      def authorize_masks_member!(*roles, organization: nil)
+        return false unless authenticate_masks!
+
+        masks_claims.member!(*roles, organization: organization)
+        true
+      rescue Masks::Client::Forbidden => e
+        masks_forbid(e)
+        false
+      end
+
       private
 
+        def masks_forbid(error)
+          response.headers["Cache-Control"] = "no-store"
+
+          if masks_wants_json?
+            render json: { "error" => error.code, "error_description" => error.description }, status: :forbidden
+          else
+            render plain: error.description, status: :forbidden
+          end
+        end
+
         def masks_refuse
           return masks_refuse_json if masks_wants_json?
           return redirect_to(masks_handshake_path) unless masks_configured?
@@ -251,9 +318,15 @@ module Masks
           path = value.to_s
 
           return nil unless path.start_with?("/")
-          return nil if path.start_with?("//", "/\\")
+          return nil if path.match?(/[\x00-\x20\x7f\\]/)
 
-          path
+          uri = URI.parse(path)
+
+          return nil if uri.scheme || uri.host || uri.userinfo || !uri.path.start_with?("/") || uri.path.start_with?("//")
+
+          [ uri.path, uri.query ].compact.join("?")
+        rescue URI::InvalidURIError
+          nil
         end
     end
   end

data/lib/masks/rails/configuration.rb

@@ -7,7 +7,7 @@ module Masks
                     :after_sign_out, :session_key, :sign_out_of_issuer, :parent_controller,
                     :credentials_path, :authenticate_everything, :delegates
       attr_writer :issuer, :redirect_uri, :name, :credentials, :store, :forget, :logged_out,
-                  :delegation_redirect_uri
+                  :delegation_redirect_uri, :organization, :manages
 
       def initialize
         @scope = Masks::Client::Session::DEFAULT_SCOPE
@@ -51,6 +51,10 @@ module Masks
         resolve(@resource, request)
       end
 
+      def organization_for(request)
+        resolve(@organization, request)
+      end
+
       def credentials_for(request)
         held = @credentials ? resolve(@credentials, request) : default_credentials.read
         held ||= {}
@@ -85,6 +89,14 @@ module Masks
         true
       end
 
+      def manages?(request, identity = nil)
+        return false unless @manages.respond_to?(:call)
+
+        held = @manages.arity == 1 ? @manages.call(request) : @manages.call(request, identity)
+
+        held ? true : false
+      end
+
       def can_forget?
         @forget.respond_to?(:call) || !@store.respond_to?(:call)
       end
@@ -102,19 +114,6 @@ module Masks
         @store.call(request, registration)
       end
 
-      MINIMUM_ISSUER = 1
-
-      def issuer_speaks!(request)
-        spoken = Masks::Client::Issuer.resolve(issuer_for(request))
-                                     .discovery["masks_protocol_version"].to_i
-
-        return true if spoken >= MINIMUM_ISSUER
-
-        raise Unconfigured,
-              "#{issuer_for(request)} speaks masks protocol #{spoken}, and masks " \
-              "#{Masks::VERSION} needs at least #{MINIMUM_ISSUER}"
-      end
-
       def session_for(request)
         raise Unconfigured, "this app has not shaken hands with #{issuer_for(request)}" unless configured?(request)
 

data/lib/masks/rails/protected_resource.rb

@@ -18,19 +18,25 @@ module Masks
         @masks_claims if defined?(@masks_claims)
       end
 
-      def masks_authenticate!(scope: nil, **)
-        @masks_claims = masks_resource.authenticate(request.authorization, scope: scope)
+      def masks_authenticate!(scope: nil, role: nil, organization: nil, **)
+        @masks_claims = masks_resource.authenticate(request.authorization, scope: scope, role: role,
+                                                                           organization: organization, **masks_proof)
       rescue Masks::Client::Challenge => e
         masks_challenge(e)
         false
       end
 
-      def masks_authenticate(scope: nil)
-        masks_resource.authenticate(request.authorization, scope: scope)
+      def masks_authenticate(scope: nil, role: nil, organization: nil)
+        masks_resource.authenticate(request.authorization, scope: scope, role: role, organization: organization,
+                                                           **masks_proof)
       rescue Masks::Client::Unauthenticated
         nil
       end
 
+      def masks_proof
+        { proof: request.headers["DPoP"], method: request.request_method, url: "#{request.base_url}#{request.path}" }
+      end
+
       def masks_challenge(error)
         error = Masks::Client::Unauthorized.new(error.to_s) unless error.is_a?(Masks::Client::Challenge)
 

data/lib/masks/rails.rb

@@ -20,8 +20,8 @@ module Masks
   # [ProtectedResource] the other direction — checking a bearer this app was
   #                    handed, for an API rather than a browser
   #
-  # This engine is the client. It never runs in the same process as the
-  # provider, which is a standalone deployable holding its own database.
+  # This engine is the client. The provider is the masks-server gem, whether
+  # it runs elsewhere or is mounted on a subdomain of this app.
   module Rails
   end
 end

data/lib/masks/version.rb

@@ -1,3 +1,3 @@
 module Masks
-  VERSION = "0.7.0".freeze
+  VERSION = "0.9.1".freeze
 end

data/lib/masks.rb

@@ -10,8 +10,8 @@
 #   issuer = Masks::Client.issuer("https://auth.example")
 #   issuer.authorization_url(client_id: id, redirect_uri: uri)
 #
-# The provider itself is not in here. It is a deployable that holds a database
-# and the per-tenant signing keys, and it stays standalone.
+# The provider itself is not in here. It is the masks-server gem, which runs
+# as an app of its own or mounted inside another Rails app.
 module Masks
 end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: masks
 version: !ruby/object:Gem::Version
-  version: 0.7.0
+  version: 0.9.1
 platform: ruby
 authors:
 - the masks authors
@@ -25,7 +25,8 @@ dependencies:
         version: '3.1'
 description: Discovery, PKCE authorization, token exchange, and token verification
   against a masks issuer, with Rack middleware for a resource server and a Rails engine
-  that mounts the consumer half of the code flow. The auth server itself stays standalone.
+  that mounts the consumer half of the code flow. The auth server itself is the masks-server
+  gem.
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -56,6 +57,7 @@ files:
 - lib/masks/client/issuer.rb
 - lib/masks/client/logout.rb
 - lib/masks/client/pkce.rb
+- lib/masks/client/proof.rb
 - lib/masks/client/rack.rb
 - lib/masks/client/registration.rb
 - lib/masks/client/registry.rb