masks 0.9.2 → 0.11.0

data/lib/masks/rails/protected_resource.rb

@@ -3,27 +3,23 @@ module Masks
     module ProtectedResource
       extend ActiveSupport::Concern
       include Masks::Rails::Configurable
+      include Masks::Rails::Privileged
 
-      class_methods do
-        def masks_protect!(**options)
-          before_action(-> { masks_authenticate!(**options) }, **options.slice(:only, :except))
-        end
+      included do
+        rescue_from Masks::Client::ReplayUnavailable, with: :masks_unavailable if respond_to?(:rescue_from)
       end
 
       def masks_resource
         @masks_resource ||= masks_config.resource_server_for(request)
       end
 
-      def masks_claims
-        @masks_claims if defined?(@masks_claims)
-      end
+      def masked
+        return (defined?(super) ? super : Masked.nobody(masks_config)) unless defined?(@masks_token_claims)
 
-      def masks_authenticate!(scope: nil, role: nil, organization: nil, **)
-        @masks_claims = masks_resource.authenticate(request.authorization, scope: scope, role: role,
-                                                                           organization: organization, **masks_proof)
-      rescue Masks::Client::Challenge => e
-        masks_challenge(e)
-        false
+        @masked_by_token ||= Masked.new(
+          claims: @masks_token_claims, scopes: @masks_token_claims.scopes, config: masks_config, signed_in: true,
+          access_token: masks_resource.token(request.authorization), expires_at: @masks_token_claims.expires_at
+        )
       end
 
       def masks_authenticate(scope: nil, role: nil, organization: nil)
@@ -49,9 +45,37 @@ module Masks
         }, status: error.status
       end
 
+      def masks_unavailable
+        response.headers["Cache-Control"] = "no-store"
+
+        render json: {
+          "error" => "temporarily_unavailable",
+          "error_description" => "the token could not be checked"
+        }, status: :service_unavailable
+      end
+
       def masks_resource_metadata
         masks_resource.metadata
       end
+
+      private
+
+        def masks_authorize_token!(privileges)
+          claims = masks_resource.authenticate(request.authorization, scope: privileges.flat_map(&:scopes).uniq,
+                                                                      **masks_proof)
+
+          privileges.each do |privilege|
+            next if privilege.roles.empty? && privilege.organization.nil?
+
+            claims.member!(*privilege.roles, organization: privilege.organization)
+          end
+
+          @masks_token_claims = claims
+          true
+        rescue Masks::Client::Challenge => e
+          masks_challenge(e)
+          false
+        end
     end
   end
 end

data/lib/masks/rails.rb

@@ -31,6 +31,8 @@ require_relative "client"
 require_relative "rails/credentials"
 require_relative "rails/configuration"
 require_relative "rails/configurable"
+require_relative "rails/masked"
+require_relative "rails/privileged"
 require_relative "rails/authentication"
 require_relative "rails/protected_resource"
 require_relative "rails/engine"

data/lib/masks/version.rb

@@ -1,3 +1,3 @@
 module Masks
-  VERSION = "0.9.2".freeze
+  VERSION = "0.11.0".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: masks
 version: !ruby/object:Gem::Version
-  version: 0.9.2
+  version: 0.11.0
 platform: ruby
 authors:
 - the masks authors
@@ -50,12 +50,17 @@ files:
 - lib/masks/client/claims.rb
 - lib/masks/client/delegations.rb
 - lib/masks/client/delegations/fake.rb
+- lib/masks/client/device.rb
+- lib/masks/client/embedded.rb
+- lib/masks/client/enrollment.rb
 - lib/masks/client/errors.rb
 - lib/masks/client/handshake.rb
 - lib/masks/client/http.rb
 - lib/masks/client/introspection.rb
 - lib/masks/client/issuer.rb
+- lib/masks/client/key.rb
 - lib/masks/client/logout.rb
+- lib/masks/client/nonces.rb
 - lib/masks/client/pkce.rb
 - lib/masks/client/proof.rb
 - lib/masks/client/rack.rb
@@ -66,6 +71,7 @@ files:
 - lib/masks/client/stores.rb
 - lib/masks/client/tokens.rb
 - lib/masks/client/tracker.rb
+- lib/masks/client/transport.rb
 - lib/masks/client/verifier.rb
 - lib/masks/rails.rb
 - lib/masks/rails/authentication.rb
@@ -73,6 +79,8 @@ files:
 - lib/masks/rails/configuration.rb
 - lib/masks/rails/credentials.rb
 - lib/masks/rails/engine.rb
+- lib/masks/rails/masked.rb
+- lib/masks/rails/privileged.rb
 - lib/masks/rails/protected_resource.rb
 - lib/masks/version.rb
 homepage: https://github.com/masksrb/masks