masks 0.9.2 → 0.11.0

data/lib/masks/client/tokens.rb

@@ -44,6 +44,10 @@ module Masks
         scope.split(/\s+/).reject(&:empty?)
       end
 
+      def bound?
+        token_type.to_s.casecmp?(Proof::SCHEME)
+      end
+
       def authorization
         "#{token_type} #{access_token}"
       end

data/lib/masks/client/transport.rb

@@ -0,0 +1,114 @@
+module Masks
+  module Client
+    class Transport
+      VERBS = {
+        "GET" => Net::HTTP::Get, "HEAD" => Net::HTTP::Head, "POST" => Net::HTTP::Post, "PUT" => Net::HTTP::Put,
+        "PATCH" => Net::HTTP::Patch, "DELETE" => Net::HTTP::Delete
+      }.freeze
+
+      attr_reader :origins, :key
+
+      def initialize(*origins, tokens: nil, key: nil, &renew)
+        raise ArgumentError, "a transport needs the origins it may send its tokens to" if origins.empty?
+        raise ArgumentError, "a transport needs tokens or a way to fetch them" if tokens.nil? && renew.nil?
+
+        @origins = origins.flatten.map { |origin| Nonces.origin(HTTP.checked(URI.parse(origin.to_s))) }.uniq.freeze
+        @tokens = tokens
+        @key = key && Key.from(key)
+        @renew = renew
+        @lock = Mutex.new
+        @nonces = Nonces.new
+      end
+
+      def tokens
+        @lock.synchronize do
+          @tokens = @renew.call(@tokens) if @renew && (@tokens.nil? || @tokens.expired?)
+          @tokens
+        end
+      end
+
+      def get(url, headers: {})
+        request("GET", url, headers: headers)
+      end
+
+      def head(url, headers: {})
+        request("HEAD", url, headers: headers)
+      end
+
+      def delete(url, headers: {})
+        request("DELETE", url, headers: headers)
+      end
+
+      def post(url, body: nil, headers: {})
+        request("POST", url, body: body, headers: headers)
+      end
+
+      def put(url, body: nil, headers: {})
+        request("PUT", url, body: body, headers: headers)
+      end
+
+      def patch(url, body: nil, headers: {})
+        request("PATCH", url, body: body, headers: headers)
+      end
+
+      def request(method, url, body: nil, headers: {}, limit: nil)
+        uri = URI.parse(url.to_s)
+        verb = VERBS.fetch(method.to_s.upcase) { raise ArgumentError, "#{method} is not a method a transport sends" }
+
+        unless origins.include?(Nonces.origin(uri))
+          raise Foreign, "this transport holds tokens only for #{origins.join(', ')}"
+        end
+
+        held = tokens
+        nonce = @nonces[uri] if held.bound?
+        response = HTTP.deliver(signed(verb, uri, body, headers, held, nonce), limit: limit)
+
+        return response unless held.bound?
+
+        wanted = @nonces.learn(uri, response)
+
+        return response unless wanted && wanted != nonce && nonce_asked?(response)
+
+        HTTP.deliver(signed(verb, uri, body, headers, held, wanted), limit: limit)
+      end
+
+      def inspect
+        "#<#{self.class.name} #{origins.join(', ')}>"
+      end
+
+      private
+
+        def signed(verb, uri, body, headers, held, nonce)
+          request = verb.new(uri, HTTP.default_headers.merge(headers))
+
+          if held.bound?
+            raise Error, "a DPoP token needs the key it is held to" if key.nil?
+
+            request["Authorization"] = "#{Proof::SCHEME} #{held.access_token}"
+            request["DPoP"] = key.proof(request.method, uri, access_token: held.access_token, nonce: nonce)
+          else
+            request["Authorization"] = "Bearer #{held.access_token}"
+          end
+
+          written(request, body)
+        end
+
+        def written(request, body)
+          return request if body.nil?
+
+          if body.is_a?(String)
+            request.body = body
+          else
+            request.body = JSON.generate(body)
+            request["Content-Type"] ||= "application/json"
+          end
+
+          request
+        end
+
+        def nonce_asked?(response)
+          response.code.to_i == 401 && response["WWW-Authenticate"].to_s.include?("use_dpop_nonce")
+        end
+    end
+  end
+end

data/lib/masks/client.rb

@@ -1,4 +1,5 @@
 require "base64"
+require "ipaddr"
 require "json"
 require "jwt"
 require "net/http"
@@ -9,14 +10,20 @@ require "uri"
 require_relative "version"
 require_relative "client/errors"
 require_relative "client/http"
+require_relative "client/embedded"
 require_relative "client/pkce"
 require_relative "client/stores"
 require_relative "client/tracker"
+require_relative "client/nonces"
+require_relative "client/key"
 require_relative "client/issuer"
 require_relative "client/registry"
 require_relative "client/tokens"
 require_relative "client/claims"
 require_relative "client/introspection"
+require_relative "client/enrollment"
+require_relative "client/device"
+require_relative "client/transport"
 require_relative "client/session"
 require_relative "client/verifier"
 require_relative "client/proof"
@@ -44,6 +51,20 @@ module Masks
   # state of its own beyond the discovery cache in ::registry.
   module Client
     class << self
+      attr_writer :plain_http
+
+      def plain_http?
+        @plain_http == true
+      end
+
+      def embed(app, &serves)
+        @embedded = app && Embedded.new(app, &serves)
+      end
+
+      def embedded_for(uri)
+        @embedded if @embedded&.serves?(uri)
+      end
+
       # The process-wide cache of resolved issuers, so discovery is fetched
       # once rather than per request.
       #

data/lib/masks/rails/authentication.rb

@@ -3,24 +3,19 @@ module Masks
     module Authentication
       extend ActiveSupport::Concern
       include Masks::Rails::Configurable
+      include Masks::Rails::Privileged
 
       included do
         if respond_to?(:helper_method)
-          helper_method :masks_signed_in?, :masks_identity, :masks_tenant, :masks_scopes,
-                        :masks_claims, :masks_organization, :masks_organizations, :masks_role?,
-                        :masks_login_url
-        end
-      end
-
-      class_methods do
-        def masks_members_only!(role: nil, organization: nil, **options)
-          before_action(-> { authorize_masks_member!(*Array(role), organization: organization) },
-                        **options.slice(:only, :except))
+          helper_method :masked, :masks_login_url
         end
       end
 
       REQUESTS = "masks_requests".freeze
       HANDSHAKES = "masks_handshakes".freeze
+      FAREWELLS = "masks_farewells".freeze
+      STEPPED_UP = "masks_stepped_up".freeze
+      STEP_UP_WITHIN = 300
 
       def masks_session
         @masks_session ||= masks_config.session_for(request)
@@ -34,6 +29,10 @@ module Masks
         @masks_handshakes ||= masks_tracker(HANDSHAKES)
       end
 
+      def masks_farewells
+        masks_tracker(FAREWELLS)
+      end
+
       def masks_tracker(key)
         Masks::Client::Tracker.new(Masks::Client::Stores::Session.new(session, key))
       end
@@ -50,8 +49,7 @@ module Masks
 
         session[masks_config.session_key] = held.compact
         @masks_tokens = tokens
-        @masks_identity = held["identity"]
-        @masks_claims = nil
+        @masked = nil
       end
 
       def masks_held
@@ -73,8 +71,19 @@ module Masks
       def masks_forget
         session.delete(masks_config.session_key)
         @masks_tokens = nil
-        @masks_identity = nil
-        @masks_claims = nil
+        @masked = nil
+      end
+
+      def masked
+        @masked ||= if masks_tokens
+          Masked.new(
+            claims: Masks::Client::Claims.new(masks_held["identity"] || {}), scopes: masks_tokens.scopes,
+            config: masks_config, signed_in: masks_signed_in?, access_token: masks_tokens.access_token,
+            expires_at: masks_tokens.expires_at, account_url: masks_account_url
+          )
+        else
+          Masked.nobody(masks_config)
+        end
       end
 
       def masks_signed_in?
@@ -119,46 +128,6 @@ module Masks
         Masks::Rails::Engine.routes.url_helpers.handshake_path
       end
 
-      def masks_identity
-        return @masks_identity if defined?(@masks_identity)
-
-        @masks_identity = masks_held["identity"]
-      end
-
-      def masks_tenant
-        masks_identity&.dig("tenant")
-      end
-
-      def masks_claims
-        @masks_claims ||= Masks::Client::Claims.new(masks_identity || {})
-      end
-
-      def masks_organization
-        held = masks_claims.organization
-
-        held.present? ? held : nil
-      end
-
-      def masks_organizations
-        masks_claims.organizations
-      end
-
-      def masks_role?(*roles)
-        masks_organization&.role?(*roles) || false
-      end
-
-      def masks_scopes
-        masks_tokens&.scopes || []
-      end
-
-      def masks_permits?(scope)
-        masks_scopes.include?(scope.to_s)
-      end
-
-      def masks_access_token
-        masks_tokens&.access_token
-      end
-
       def masks_refresh!
         return false unless masks_configured?
         return false if masks_tokens&.refresh_token.nil?
@@ -188,52 +157,28 @@ module Masks
         profile.empty? ? nil : held.merge(profile.slice(*IDENTITY))
       end
 
-      def masks_logout_url(return_to: nil)
+      def masks_logout_url(state:)
         return nil unless masks_configured?
 
         masks_session.end_session_url(
-          post_logout_redirect_uri: masks_post_logout_redirect_uri,
-          state: SecureRandom.urlsafe_base64(16)
+          post_logout_redirect_uri: masks_config.return_to_for(request),
+          state: state
         )
       rescue Masks::Client::Error
         nil
       end
 
-      def masks_post_logout_redirect_uri
-        "#{request.base_url}#{masks_local_path(masks_config.after_sign_out) || '/'}"
-      end
-
-      def masks_login_url(return_to: nil, organization: nil)
+      def masks_login_url(return_to: nil, organization: nil, privilege: nil)
         path = Masks::Rails::Engine.routes.url_helpers.start_path
         query = {
           "return_to" => masks_local_path(return_to),
-          "organization" => Masks::Client::Session.organization_key(organization)
+          "organization" => Masks::Client::Session.organization_key(organization),
+          "privilege" => Array(privilege).join(" ").presence
         }.compact
 
         query.empty? ? path : "#{path}?#{URI.encode_www_form(query)}"
       end
 
-      def masks_account
-        identity = masks_identity || {}
-
-        {
-          "signed_in" => masks_signed_in?,
-          "subject" => identity["sub"],
-          "name" => identity["name"],
-          "nickname" => identity["preferred_username"],
-          "email" => identity["email"],
-          "email_verified" => identity["email_verified"],
-          "picture" => masks_claims.picture,
-          "avatars" => masks_claims.avatars.to_h.presence,
-          "tenant" => masks_tenant,
-          "organization" => masks_organization&.to_h,
-          "organizations" => masks_organizations.map(&:to_h).presence,
-          "scopes" => masks_scopes,
-          "expires_at" => masks_tokens&.expires_at,
-          "account_url" => masks_account_url
-        }.compact
-      end
-
       def masks_account_url
         "#{masks_config.issuer_for(request).to_s.chomp('/')}/"
       rescue Masks::Rails::Configuration::Unconfigured
@@ -247,17 +192,63 @@ module Masks
         false
       end
 
-      def authorize_masks_member!(*roles, organization: nil)
-        return false unless authenticate_masks!
+      private
 
-        masks_claims.member!(*roles, organization: organization)
-        true
-      rescue Masks::Client::Forbidden => e
-        masks_forbid(e)
-        false
-      end
+        def masks_sign_out_upstream
+          return nil unless masks_configured?
 
-      private
+          farewell = masks_farewells.open
+          url = masks_logout_url(state: farewell.id)
+
+          masks_farewells.clear! if url.nil?
+          url
+        end
+
+        def masks_after_sign_out_path
+          masks_local_path(masks_config.after_sign_out) || "/"
+        end
+
+        def masks_authorize_session!(wanted)
+          return false unless authenticate_masks!
+
+          wanted.each { |privilege| masked.member!(privilege) }
+
+          missing = wanted.reject { |privilege| (privilege.scopes - masked.scopes).empty? }.map(&:name)
+          return true if missing.empty?
+
+          if masks_asked_already?(session.delete(STEPPED_UP), missing)
+            raise Masks::Client::Forbidden.new(
+              "insufficient_scope", "this account does not hold the #{missing.join(' and ')} privilege",
+              scope: missing.flat_map { |name| masks_config.privilege(name).scopes }.join(" ")
+            )
+          end
+
+          masks_ask_again(missing)
+          false
+        rescue Masks::Client::Forbidden => e
+          masks_forbid(e)
+          false
+        end
+
+        def masks_asked_already?(asked, missing)
+          asked.is_a?(Hash) && (missing - Array(asked["privileges"])).empty? &&
+            asked["at"].to_i > Time.now.to_i - STEP_UP_WITHIN
+        end
+
+        def masks_ask_again(missing)
+          return_to = request.get? ? request.fullpath : masks_referring_path
+          url = masks_login_url(return_to: return_to, privilege: missing)
+
+          session[STEPPED_UP] = { "privileges" => missing, "at" => Time.now.to_i }
+
+          if masks_wants_json?
+            response.headers["Cache-Control"] = "no-store"
+            render json: { "error" => "privilege_required", "privileges" => missing, "login_url" => url },
+                   status: :forbidden
+          else
+            redirect_to url
+          end
+        end
 
         def masks_forbid(error)
           response.headers["Cache-Control"] = "no-store"

data/lib/masks/rails/configuration.rb

@@ -3,14 +3,19 @@ module Masks
     class Configuration
       class Unconfigured < Masks::Client::Error; end
 
+      Privilege = Struct.new(:name, :scopes, :roles, :organization, keyword_init: true)
+      PRIVILEGE_KEYS = %w[scope role organization].freeze
+
+      attr_reader :privileges
       attr_accessor :scope, :namespace, :resource, :resource_scopes, :after_sign_in,
                     :after_sign_out, :session_key, :sign_out_of_issuer, :parent_controller,
                     :credentials_path, :authenticate_everything, :delegates
       attr_writer :issuer, :redirect_uri, :name, :credentials, :store, :forget, :logged_out,
-                  :delegation_redirect_uri, :organization, :manages
+                  :delegation_redirect_uri, :organization, :manages, :replay
 
       def initialize
         @scope = Masks::Client::Session::DEFAULT_SCOPE
+        @privileges = {}
         @resource_scopes = []
         @after_sign_in = "/"
         @after_sign_out = "/"
@@ -89,12 +94,12 @@ module Masks
         true
       end
 
-      def manages?(request, identity = nil)
-        return false unless @manages.respond_to?(:call)
-
-        held = @manages.arity == 1 ? @manages.call(request) : @manages.call(request, identity)
-
-        held ? true : false
+      def manages?(request, masked = nil)
+        case @manages
+        when Symbol, String then masked&.privilege?(@manages) || false
+        when nil then false
+        else (@manages.arity == 1 ? @manages.call(request) : @manages.call(request, masked)) ? true : false
+        end
       end
 
       def can_forget?
@@ -134,10 +139,15 @@ module Masks
         Masks::Client::Resource.new(
           issuer: issuer_for(request),
           url: url,
-          scopes: resource_scopes
+          scopes: resource_scopes,
+          replay: replay
         )
       end
 
+      def replay
+        @replay || Masks::Client::Proof.memory
+      end
+
       def handshake_for(request)
         Masks::Client::Handshake.new(
           issuer_for(request),
@@ -151,12 +161,34 @@ module Masks
         )
       end
 
+      def privileges=(value)
+        @privileges = value.to_h.to_h do |name, spec|
+          held = spec.is_a?(Hash) ? spec.transform_keys(&:to_s) : { "scope" => spec }
+          unknown = held.keys - PRIVILEGE_KEYS
+
+          raise ArgumentError, "the #{name} privilege names #{unknown.join(', ')}, which is not #{PRIVILEGE_KEYS.join(', ')}" if unknown.any?
+
+          [ name.to_s, Privilege.new(name: name.to_s, scopes: Array(held["scope"]).map(&:to_s),
+                                     roles: Array(held["role"]).map(&:to_s), organization: held["organization"]&.to_s) ]
+        end
+      end
+
+      def privilege(name)
+        privileges.fetch(name.to_s) { raise ArgumentError, "Masks::Rails.config.privileges has no #{name}" }
+      end
+
+      def scope_for(requested)
+        wanted = (requested.to_s.split & privileges.keys).flat_map { |name| privileges[name].scopes }
+        wanted.empty? ? nil : (Array(scope) + wanted).uniq
+      end
+
       def approved_scope
         delegated = delegates ? [ Masks::Client::Delegations::SCOPE ] : []
 
-        return Array(scope) + delegated if namespace.blank?
+        asked = (Array(scope) + privileges.values.flat_map(&:scopes)).uniq
+        return asked + delegated if namespace.blank?
 
-        outside = Array(scope).reject { |name| name.to_s.start_with?(namespace) }
+        outside = asked.reject { |name| name.to_s.start_with?(namespace) }
 
         outside + [ namespace ] + delegated
       end

data/lib/masks/rails/masked.rb

@@ -0,0 +1,126 @@
+module Masks
+  module Rails
+    class Masked
+      attr_reader :claims, :scopes, :access_token, :expires_at, :account_url
+
+      def self.nobody(config)
+        new(claims: Masks::Client::Claims.new({}), scopes: [], config: config, signed_in: false)
+      end
+
+      def initialize(claims:, scopes:, config:, signed_in:, access_token: nil, expires_at: nil, account_url: nil)
+        @claims = claims
+        @scopes = Array(scopes).map(&:to_s).freeze
+        @config = config
+        @signed_in = signed_in
+        @access_token = access_token
+        @expires_at = expires_at
+        @account_url = account_url
+      end
+
+      def signed_in?
+        @signed_in
+      end
+
+      def [](claim)
+        claims[claim]
+      end
+
+      def subject
+        claims.subject
+      end
+
+      def name
+        claims["name"]
+      end
+
+      def nickname
+        claims["preferred_username"]
+      end
+
+      def email
+        claims["email"]
+      end
+
+      def email_verified?
+        claims["email_verified"] == true
+      end
+
+      def picture
+        claims.picture
+      end
+
+      def avatars
+        claims.avatars
+      end
+
+      def tenant
+        claims.tenant
+      end
+
+      def organization
+        held = claims.organization
+
+        held.present? ? held : nil
+      end
+
+      def organizations
+        claims.organizations
+      end
+
+      def role?(*roles)
+        organization&.role?(*roles) || false
+      end
+
+      def permits?(scope)
+        scopes.include?(scope.to_s)
+      end
+
+      def privileges
+        return [] unless signed_in?
+
+        @config.privileges.values.select { |privilege| holds?(privilege) }.map(&:name)
+      end
+
+      def privilege?(*names)
+        wanted = names.flatten.map { |name| @config.privilege(name) }
+
+        signed_in? && wanted.all? { |privilege| holds?(privilege) }
+      end
+
+      def holds?(privilege)
+        return false unless (privilege.scopes - scopes).empty?
+
+        member!(privilege)
+        true
+      rescue Masks::Client::Forbidden
+        false
+      end
+
+      def member!(privilege)
+        return if privilege.roles.empty? && privilege.organization.nil?
+
+        claims.member!(*privilege.roles, organization: privilege.organization)
+      end
+
+      def to_h
+        {
+          "signed_in" => signed_in?,
+          "subject" => subject,
+          "name" => name,
+          "nickname" => nickname,
+          "email" => email,
+          "email_verified" => claims["email_verified"],
+          "picture" => picture,
+          "avatars" => avatars.to_h.presence,
+          "tenant" => claims["tenant"],
+          "organization" => organization&.to_h,
+          "organizations" => organizations.map(&:to_h).presence,
+          "scopes" => scopes,
+          "privileges" => privileges,
+          "expires_at" => expires_at,
+          "account_url" => account_url
+        }.compact
+      end
+    end
+  end
+end

data/lib/masks/rails/privileged.rb

@@ -0,0 +1,29 @@
+module Masks
+  module Rails
+    module Privileged
+      extend ActiveSupport::Concern
+      include Masks::Rails::Configurable
+
+      class_methods do
+        def masked!(*privileges, **options)
+          before_action(-> { authorize_masks!(*privileges) }, **options.slice(:only, :except))
+        end
+      end
+
+      def authorize_masks!(*names)
+        privileges = names.flatten.map { |name| masks_config.privilege(name) }
+
+        masks_by_token? ? masks_authorize_token!(privileges) : masks_authorize_session!(privileges)
+      end
+
+      private
+
+        def masks_by_token?
+          return false unless respond_to?(:masks_authorize_token!, true)
+          return true if request.authorization.present? || !respond_to?(:masks_authorize_session!, true)
+
+          masks_tokens.nil?
+        end
+    end
+  end
+end