masks 0.9.2 → 0.11.0

data/lib/masks/client/enrollment.rb

@@ -0,0 +1,33 @@
+module Masks
+  module Client
+    class Enrollment
+      attr_reader :initial_access_token, :scope, :expires_in, :obtained_at
+
+      def self.issued(body)
+        if body["initial_access_token"].to_s.empty?
+          raise Rejected.new(
+            body["error"] || "invalid_enrollment_response",
+            body["error_description"] || "the enrollment endpoint answered without an initial_access_token"
+          )
+        end
+
+        new(body)
+      end
+
+      def initialize(body)
+        @initial_access_token = body["initial_access_token"]
+        @scope = body["scope"].to_s
+        @expires_in = body["expires_in"].to_i
+        @obtained_at = Time.now.to_i
+      end
+
+      def expires_at
+        obtained_at + expires_in
+      end
+
+      def scopes
+        scope.split
+      end
+    end
+  end
+end

data/lib/masks/client/errors.rb

@@ -4,6 +4,12 @@ module Masks
 
     class Unreachable < Error; end
 
+    class Foreign < Error; end
+
+    class Insecure < Error; end
+
+    class ReplayUnavailable < Error; end
+
     class Rejected < Error
       attr_reader :code, :description, :status
 

data/lib/masks/client/http.rb

@@ -3,6 +3,7 @@ module Masks
     module HTTP
       OPEN_TIMEOUT = 5
       READ_TIMEOUT = 10
+      READ_LIMIT = 1 << 20
 
       module_function
 
@@ -11,12 +12,22 @@ module Masks
       end
 
       def post_form(url, form, headers = {})
-        uri = URI.parse(url.to_s)
-        request = Net::HTTP::Post.new(uri, default_headers.merge(headers))
+        encoded(Net::HTTP::Post, url, form, headers)
+      end
+
+      def delete_form(url, form, headers = {})
+        encoded(Net::HTTP::Delete, url, form, headers)
+      end
+
+      def encoded(verb, url, form, headers)
+        request(form_request(verb, url, form, headers))
+      end
+
+      def form_request(verb, url, form, headers)
+        request = verb.new(URI.parse(url.to_s), default_headers.merge(headers))
         request.body = URI.encode_www_form(form)
         request["Content-Type"] = "application/x-www-form-urlencoded"
-
-        self.request(request)
+        request
       end
 
       def post_json(url, body, headers = {})
@@ -32,7 +43,10 @@ module Masks
       end
 
       def fetch(url, headers = {})
-        uri = URI.parse(url.to_s)
+        uri = checked(URI.parse(url.to_s))
+        embedded = Masks::Client.embedded_for(uri)
+
+        return embedded.deliver(Net::HTTP::Get.new(uri, headers)) if embedded
 
         Net::HTTP.start(
           uri.hostname, uri.port,
@@ -58,26 +72,62 @@ module Masks
       end
 
       def request(request)
-        uri = request.uri
+        parse(deliver(request))
+      end
+
+      def deliver(request, limit: READ_LIMIT)
+        uri = checked(request.uri)
+        embedded = Masks::Client.embedded_for(uri)
 
-        response = Net::HTTP.start(
+        return embedded.deliver(request, limit: limit) if embedded
+
+        Net::HTTP.start(
           uri.hostname, uri.port,
           use_ssl: uri.scheme == "https",
           open_timeout: OPEN_TIMEOUT,
           read_timeout: READ_TIMEOUT
-        ) { |http| http.request(request) }
-
-        parse(response)
+        ) { |http| limit ? limited(http, request, limit) : http.request(request) }
       rescue SystemCallError, SocketError, Net::OpenTimeout, Net::ReadTimeout, OpenSSL::SSL::SSLError => e
         raise Unreachable, "#{uri.host} is unreachable (#{e.class})"
       end
 
-      def parse(response)
-        body = begin
-          JSON.parse(response.body.to_s)
-        rescue JSON::ParserError
-          {}
+      def checked(uri)
+        return uri if uri.is_a?(URI::HTTPS) && !uri.host.to_s.empty?
+        return uri if uri.is_a?(URI::HTTP) && !uri.host.to_s.empty? && (Masks::Client.plain_http? || loopback?(uri.hostname))
+
+        if uri.is_a?(URI::HTTP)
+          raise Insecure, "#{Nonces.origin(uri)} is plain http, which masks allows only for loopback hosts " \
+                          "unless Masks::Client.plain_http is set"
+        end
+
+        raise Error, "#{uri} is not an http or https URL"
+      end
+
+      def loopback?(host)
+        name = host.to_s.downcase
+
+        return true if name == "localhost" || name.end_with?(".localhost")
+
+        IPAddr.new(name).loopback?
+      rescue IPAddr::Error
+        false
+      end
+
+      def limited(http, request, limit)
+        http.request(request) do |response|
+          body = +""
+
+          response.read_body do |chunk|
+            body << chunk
+            raise Error, "#{request.uri.host} answered with more than #{limit} bytes" if body.bytesize > limit
+          end
+
+          response.body = body
         end
+      end
+
+      def parse(response)
+        body = decoded(response)
 
         unless response.is_a?(Net::HTTPSuccess)
           refusal = Unregistered.raised_by?(body) ? Unregistered : Rejected
@@ -91,6 +141,30 @@ module Masks
 
         body
       end
+
+      def decoded(response)
+        raw = response.body.to_s
+        return {} if raw.strip.empty?
+
+        held = JSON.parse(raw)
+
+        return held if held.is_a?(Hash)
+        return {} unless response.is_a?(Net::HTTPSuccess)
+
+        raise Rejected.new("invalid_response", "#{origin(response)} answered with JSON that is not an object",
+                           status: response.code.to_i)
+      rescue JSON::ParserError
+        return {} unless response.is_a?(Net::HTTPSuccess)
+
+        raise Rejected.new("invalid_response", "#{origin(response)} answered with something other than JSON",
+                           status: response.code.to_i)
+      end
+
+      def origin(response)
+        uri = response.uri
+
+        uri ? Nonces.origin(uri) : "the server"
+      end
     end
   end
 end

data/lib/masks/client/issuer.rb

@@ -14,13 +14,14 @@ module Masks
         Masks::Client.registry[issuer, ttl: ttl]
       end
 
-      attr_reader :url
+      attr_reader :url, :nonces
 
       def initialize(url, ttl: TTL)
         @url = self.class.normalize(url)
         @ttl = ttl
         @cache = {}
         @lock = Mutex.new
+        @nonces = Nonces.new
       end
 
       def discovery

data/lib/masks/client/key.rb

@@ -0,0 +1,100 @@
+module Masks
+  module Client
+    class Key
+      CURVE = "prime256v1".freeze
+      ALGORITHM = "ES256".freeze
+      PUBLIC = %w[kty crv x y].freeze
+
+      def self.generate
+        new(OpenSSL::PKey::EC.generate(CURVE))
+      end
+
+      def self.parse(data)
+        held = data.is_a?(String) && !data.lstrip.start_with?("{") ? OpenSSL::PKey.read(data) : imported(data)
+
+        new(held)
+      rescue OpenSSL::PKey::PKeyError, JSON::ParserError, JWT::JWKError, ArgumentError
+        raise ArgumentError, "a key is a private P-256 key, as a PEM or a JWK"
+      end
+
+      def self.from(value)
+        case value
+        when self then value
+        when OpenSSL::PKey::PKey then new(value)
+        else parse(value)
+        end
+      end
+
+      def self.imported(data)
+        held = data.is_a?(String) ? JSON.parse(data) : data.to_h
+
+        JWT::JWK.import(held.transform_keys(&:to_sym)).signing_key
+      end
+
+      def self.htu(url)
+        uri = URI.parse(url.to_s)
+        uri.query = nil
+        uri.fragment = nil
+
+        uri.to_s
+      end
+
+      attr_reader :private_key, :thumbprint
+
+      def initialize(private_key)
+        unless private_key.is_a?(OpenSSL::PKey::EC) && private_key.private? && private_key.group.curve_name == CURVE
+          raise ArgumentError, "a key is a private P-256 key"
+        end
+
+        @private_key = private_key
+        @public = JWT::JWK.new(private_key).export.transform_keys(&:to_s).slice(*PUBLIC).freeze
+        @thumbprint = Proof.thumbprint(@public)
+      end
+
+      alias_method :kid, :thumbprint
+
+      def public_jwk
+        @public.merge("kid" => thumbprint, "alg" => ALGORITHM, "use" => "sig")
+      end
+
+      def jwks
+        { "keys" => [ public_jwk ] }
+      end
+
+      def to_h
+        JWT::JWK.new(private_key).export(include_private: true).transform_keys(&:to_s)
+                .merge("kid" => thumbprint, "alg" => ALGORITHM, "use" => "sig")
+      end
+
+      def to_json(*)
+        JSON.generate(to_h)
+      end
+
+      def to_pem
+        private_key.private_to_pem
+      end
+
+      def inspect
+        "#<#{self.class.name} #{thumbprint}>"
+      end
+
+      def sign(claims, header = {})
+        JWT.encode(claims, private_key, ALGORITHM, header)
+      end
+
+      def proof(method, url, access_token: nil, nonce: nil)
+        claims = {
+          "jti" => SecureRandom.urlsafe_base64(24),
+          "htm" => method.to_s.upcase,
+          "htu" => self.class.htu(url),
+          "iat" => Time.now.to_i
+        }
+
+        claims["ath"] = Proof.digest(access_token) unless access_token.to_s.empty?
+        claims["nonce"] = nonce unless nonce.to_s.empty?
+
+        sign(claims, { typ: Proof::TYPE, jwk: @public })
+      end
+    end
+  end
+end

data/lib/masks/client/nonces.rb

@@ -0,0 +1,31 @@
+module Masks
+  module Client
+    class Nonces
+      HEADER = "DPoP-Nonce".freeze
+
+      def self.origin(url)
+        uri = url.is_a?(URI::Generic) ? url : URI.parse(url.to_s)
+        port = ":#{uri.port}" unless uri.port.nil? || uri.port == uri.default_port
+
+        "#{uri.scheme.to_s.downcase}://#{uri.host.to_s.downcase}#{port}"
+      end
+
+      def initialize
+        @held = {}
+        @lock = Mutex.new
+      end
+
+      def [](url)
+        @lock.synchronize { @held[self.class.origin(url)] }
+      end
+
+      def learn(url, response)
+        wanted = response[HEADER].to_s.strip
+
+        return nil if wanted.empty?
+
+        @lock.synchronize { @held[self.class.origin(url)] = wanted }
+      end
+    end
+  end
+end

data/lib/masks/client/proof.rb

@@ -139,11 +139,17 @@ module Masks
           jti = claims["jti"].to_s
 
           raise Invalid, "a proof must carry a jti" if jti.empty?
-          return if @replay.nil? || @replay.first?("#{thumbprint}:#{jti}", expires_in: MEMORY)
+          return if @replay.nil? || first?("#{thumbprint}:#{jti}")
 
           raise Invalid, "that proof has already been used"
         end
 
+        def first?(key)
+          @replay.first?(key, expires_in: MEMORY)
+        rescue StandardError => e
+          raise ReplayUnavailable, "the replay store could not say whether that proof is new (#{e.class})"
+        end
+
         def same?(held, expected)
           !held.to_s.empty? && held.bytesize == expected.to_s.bytesize &&
             OpenSSL.fixed_length_secure_compare(held, expected.to_s)

data/lib/masks/client/rack.rb

@@ -25,6 +25,8 @@ module Masks
         return passthrough(env, e) if @optional && e.is_a?(Unauthenticated)
 
         refuse(resource(env), e)
+      rescue ReplayUnavailable
+        unavailable
       end
 
       private
@@ -56,6 +58,12 @@ module Masks
           @resource.respond_to?(:call) ? @resource.call(env) : @resource
         end
 
+        def unavailable
+          body = JSON.generate({ "error" => "temporarily_unavailable", "error_description" => "the token could not be checked" })
+
+          [ 503, { "content-type" => "application/json", "cache-control" => "no-store" }, [ body ] ]
+        end
+
         def refuse(resource, error)
           body = JSON.generate(
             { "error" => error.code, "error_description" => error.description }.compact

data/lib/masks/client/registration.rb

@@ -6,31 +6,41 @@ module Masks
       def self.create(issuer, token: nil, **attributes)
         issuer = Issuer.resolve(issuer)
         headers = token ? { "Authorization" => "Bearer #{token}" } : {}
-        body = HTTP.post_json(
-          issuer.endpoint("registration_endpoint"), stringify(attributes), headers
-        )
+        body = HTTP.post_json(endpoint(issuer, token), stringify(attributes), headers)
 
         new(issuer, body)
       end
 
+      def self.endpoint(issuer, token)
+        return issuer.endpoint("registration_endpoint") if token.nil? || issuer.discovery["registration_endpoint"]
+
+        "#{issuer.url}/register"
+      end
+
       def self.stringify(attributes)
         {
           "client_name" => attributes[:name] || attributes[:client_name],
           "redirect_uris" => Array(attributes[:redirect_uris]),
-          "grant_types" => fallback(attributes[:grant_types], %w[authorization_code]),
-          "response_types" => fallback(attributes[:response_types], %w[code]),
+          "grant_types" => Array(attributes[:grant_types]),
+          "response_types" => Array(attributes[:response_types]),
           "scope" => Array(attributes[:scope]).join(" "),
           "token_endpoint_auth_method" => attributes[:token_endpoint_auth_method],
           "application_type" => attributes[:application_type],
           "client_uri" => attributes[:client_uri],
           "logo_uri" => attributes[:logo_uri],
-          "backchannel_logout_uri" => attributes[:backchannel_logout_uri]
+          "backchannel_logout_uri" => attributes[:backchannel_logout_uri],
+          "jwks" => keyset(attributes[:jwks]),
+          "dpop_bound_access_tokens" => attributes[:dpop_bound_access_tokens]
         }.reject { |_, value| value.nil? || (value.respond_to?(:empty?) && value.empty?) }
       end
 
-      def self.fallback(value, default)
-        list = Array(value)
-        list.empty? ? default : list
+      def self.keyset(value)
+        case value
+        when nil then nil
+        when Key then value.jwks
+        when Array then { "keys" => value.map { |key| key.is_a?(Key) ? key.public_jwk : key } }
+        else value
+        end
       end
 
       def self.held(issuer, credentials)
@@ -62,18 +72,18 @@ module Masks
       GONE = (REFUSED + [ 404 ]).freeze
 
       def read
-        still_ours(REFUSED) { HTTP.get(uri, authorization) }
+        still_ours(REFUSED) { HTTP.get(owned, authorization) }
       end
 
       def update(**attributes)
         @metadata = metadata.merge(
-          still_ours(REFUSED) { HTTP.put_json(uri, self.class.stringify(attributes), authorization) }
+          still_ours(REFUSED) { HTTP.put_json(owned, self.class.stringify(attributes), authorization) }
         )
         self
       end
 
       def delete
-        still_ours(GONE) { HTTP.delete(uri, authorization) }
+        still_ours(GONE) { HTTP.delete(owned, authorization) }
         true
       end
 
@@ -88,18 +98,25 @@ module Masks
         { "Authorization" => "Bearer #{access_token}" }
       end
 
-      def session(redirect_uri:, scope: Session::DEFAULT_SCOPE)
+      def session(redirect_uri: nil, scope: Session::DEFAULT_SCOPE, **options)
         Session.new(
           issuer: issuer,
           client_id: client_id,
-          client_secret: client_secret,
+          client_secret: (client_secret unless options[:private_key]),
           redirect_uri: redirect_uri,
-          scope: scope
+          scope: scope,
+          **options
         )
       end
 
       private
 
+        def owned
+          return uri if Nonces.origin(uri) == Nonces.origin(issuer.url)
+
+          raise Foreign, "the registration names #{Nonces.origin(uri)}, which is not #{issuer.url}"
+        end
+
         def still_ours(statuses)
           yield
         rescue Unregistered

data/lib/masks/client/session.rb

@@ -13,17 +13,21 @@ module Masks
       ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer".freeze
       ASSERTION_LIFETIME = 60
 
-      attr_reader :issuer, :client_id, :client_secret, :redirect_uri, :scope, :private_key, :key_id
+      NO_NONCE = "use_dpop_nonce".freeze
+
+      attr_reader :issuer, :client_id, :client_secret, :redirect_uri, :scope, :private_key, :key_id, :dpop
 
       def initialize(issuer:, client_id:, redirect_uri: nil, client_secret: nil, private_key: nil, key_id: nil,
-                     scope: DEFAULT_SCOPE)
+                     dpop: nil, scope: DEFAULT_SCOPE)
         raise ArgumentError, "a client authenticates with a secret or a private key, not both" if client_secret && private_key
 
         @issuer = Issuer.resolve(issuer)
         @client_id = client_id
         @client_secret = client_secret
-        @private_key = private_key.is_a?(String) ? OpenSSL::PKey.read(private_key) : private_key
-        @key_id = key_id
+        @private_key = private_key.is_a?(Key) ? private_key.private_key : private_key
+        @private_key = OpenSSL::PKey.read(@private_key) if @private_key.is_a?(String)
+        @key_id = key_id || (private_key.thumbprint if private_key.is_a?(Key))
+        @dpop = dpop && Key.from(dpop)
         @redirect_uri = redirect_uri
         @scope = Array(scope)
       end
@@ -71,7 +75,7 @@ module Masks
 
         Array(resource).each { |value| form << [ "resource", value ] }
 
-        Tokens.granted(post("token_endpoint", form))
+        token(form)
       end
 
       def client_credentials(scope: nil, resource: nil)
@@ -80,7 +84,23 @@ module Masks
         form << [ "scope", Array(scope).join(" ") ] if scope
         Array(resource).each { |value| form << [ "resource", value ] }
 
-        Tokens.granted(post("token_endpoint", form))
+        token(form)
+      end
+
+      def enroll(scope:, name: nil, expires_in: nil)
+        form = [ [ "client_id", client_id ], [ "scope", Array(scope).join(" ") ] ]
+
+        form << [ "client_name", name ] if name
+        form << [ "expires_in", expires_in.to_i ] if expires_in
+
+        Enrollment.issued(post("enrollment_endpoint", form))
+      end
+
+      def unenroll(machine_id)
+        url = "#{issuer.endpoint('enrollment_endpoint')}/#{URI.encode_www_form_component(machine_id)}"
+
+        HTTP.delete_form(url, [ [ "client_id", client_id ] ] + assertion, authorization)
+        true
       end
 
       def refresh(refresh_token, resource: nil, scope: nil)
@@ -93,7 +113,7 @@ module Masks
         form << [ "scope", Array(scope).join(" ") ] if scope
         Array(resource).each { |value| form << [ "resource", value ] }
 
-        Tokens.granted(post("token_endpoint", form))
+        token(form)
       end
 
       def exchange(subject_token, scope: nil, resource: nil, lifetime: nil, requested_token_type: nil, audience: nil,
@@ -114,7 +134,46 @@ module Masks
         form << [ "requested_lifetime", lifetime.to_i ] if lifetime
         Array(resource).each { |value| form << [ "resource", value ] }
 
-        Tokens.granted(post("token_endpoint", form))
+        token(form)
+      end
+
+      def device_authorization(scope: nil, resource: nil)
+        form = [ [ "client_id", client_id ] ]
+
+        form << [ "scope", Array(scope).join(" ") ] if scope
+        Array(resource).each { |value| form << [ "resource", value ] }
+
+        Device.issued(post("device_authorization_endpoint", form))
+      end
+
+      def await_device(device, pause: Device::INTERVAL)
+        form = [ [ "grant_type", Device::GRANT_TYPE ], [ "device_code", device.device_code ], [ "client_id", client_id ] ]
+        interval = device.interval.positive? ? device.interval : pause
+
+        loop do
+          raise Rejected.new("expired_token", "the code expired before anyone approved it") if device.expired?
+
+          sleep(interval)
+
+          begin
+            return token(form)
+          rescue Rejected => e
+            case e.code
+            when "authorization_pending" then next
+            when "slow_down" then interval += pause
+            else raise
+            end
+          end
+        end
+      end
+
+      def transport(*origins, tokens: nil, scope: nil, resource: nil, &keep)
+        Transport.new(*origins, tokens: tokens, key: dpop) do |held|
+          renewed = tokens ? renew(held, scope: scope, resource: resource) : client_credentials(scope: scope, resource: resource)
+
+          keep&.call(renewed)
+          renewed
+        end
       end
 
       def revoke(token, hint: nil)
@@ -147,8 +206,13 @@ module Masks
         )
       end
 
-      def userinfo(access_token)
-        HTTP.get(issuer.endpoint("userinfo_endpoint"), "Authorization" => "Bearer #{access_token}")
+      def userinfo(tokens)
+        url = issuer.endpoint("userinfo_endpoint")
+
+        return HTTP.get(url, "Authorization" => "Bearer #{tokens}") unless tokens.is_a?(Tokens)
+        return HTTP.get(url, "Authorization" => "Bearer #{tokens.access_token}") unless tokens.bound?
+
+        HTTP.parse(Transport.new(url, tokens: tokens, key: dpop).request("GET", url, limit: HTTP::READ_LIMIT))
       end
 
       def identity(tokens)
@@ -162,19 +226,64 @@ module Masks
       def profile(tokens)
         return {} if tokens.access_token.nil?
 
-        userinfo(tokens.access_token)
+        userinfo(tokens)
       rescue Masks::Client::Error
         {}
       end
 
       private
 
+        def renew(held, scope:, resource:)
+          if held&.refresh_token.to_s.empty?
+            raise Rejected.new("invalid_grant", "there is no refresh token to renew these tokens with")
+          end
+
+          renewed = refresh(held.refresh_token, scope: scope, resource: resource)
+
+          return renewed if renewed.refresh_token
+
+          Tokens.from_h(renewed.to_h.merge("refresh_token" => held.refresh_token))
+        end
+
+        def token(form)
+          tokens = Tokens.granted(dpop ? proven(issuer.endpoint("token_endpoint"), form) : post("token_endpoint", form))
+
+          if dpop && !tokens.bound?
+            raise Rejected.new("invalid_dpop_proof", "the token endpoint answered with a token that is not held to this key")
+          end
+
+          tokens
+        end
+
         def post(endpoint, form)
           url = issuer.endpoint(endpoint)
 
           HTTP.post_form(url, form + assertion, authorization)
         end
 
+        def proven(url, form)
+          nonce = issuer.nonces[url]
+          response = HTTP.deliver(proven_request(url, form, nonce))
+          wanted = issuer.nonces.learn(url, response)
+
+          begin
+            HTTP.parse(response)
+          rescue Rejected => e
+            raise unless e.code == NO_NONCE && wanted && wanted != nonce
+
+            response = HTTP.deliver(proven_request(url, form, wanted))
+            issuer.nonces.learn(url, response)
+
+            HTTP.parse(response)
+          end
+        end
+
+        def proven_request(url, form, nonce)
+          headers = authorization.merge("DPoP" => dpop.proof("POST", url, nonce: nonce))
+
+          HTTP.form_request(Net::HTTP::Post, url, form + assertion, headers)
+        end
+
         def assertion
           return [] if private_key.nil?