open-loam 0.2.0 → 0.3.0

data/lib/open_loam/sso.rb

@@ -32,6 +32,11 @@ module OpenLoam
     # (cross-domain account takeover), so the flow refuses it.
     class DomainMismatchError < Error; end
 
+    # The provider has not proven it owns its `domain`, so it may not adopt an
+    # existing account. Ownership is stamped out of band by an operator
+    # (rake open_loam:sso:verify_domain).
+    class UnverifiedDomainError < Error; end
+
     class << self
       attr_writer :builder
 
@@ -60,11 +65,14 @@ module OpenLoam
       # OpenLoam::Membership.tenants_for): "which tenant's IdP owns this email
       # domain?" is asked at the sign-in page, before any tenant is chosen, so it
       # reaches across tenants via `unscoped` — something host code must never do.
+      #
+      # Verified providers only: the domain is manager-typed, so an unverified
+      # claim would capture every sign-in on a domain the tenant does not own.
       def provider_for(email:)
         domain = email.to_s.split("@").last.to_s.strip.downcase
         return nil if domain.blank?
 
-        OpenLoam::SsoProvider.unscoped.where(domain: domain, active: true).first
+        OpenLoam::SsoProvider.unscoped.domain_verified.where(domain: domain, active: true).first
       end
 
       # Resolve verified IdP claims to a signed-in User, in the provider's tenant.
@@ -87,7 +95,7 @@ module OpenLoam
         # Resolve the user: the durable (provider, sub) identity first, then an
         # existing User by verified email (link), else just-in-time create.
         identity = OpenLoam::SsoIdentity.find_by(sso_provider_id: provider.id, sub: claims.sub)
-        user = identity&.user || User.find_by(email: claims.email) || jit_create_user(claims)
+        user = identity&.user || link_or_create_user(provider, claims)
 
         # Re-map claims -> role on EVERY login (including a returning identity),
         # so an IdP role change takes effect.
@@ -106,6 +114,19 @@ module OpenLoam
 
       private
 
+      # `User` is global, so linking adopts an account this tenant did not create
+      # — allowed only once the provider proved it owns the domain. JIT-creating
+      # needs no proof: the new user lands in the claimant's own tenant.
+      def link_or_create_user(provider, claims)
+        existing = User.find_by(email: claims.email)
+        return jit_create_user(claims) if existing.nil?
+        return existing if provider.domain_verified?
+
+        raise UnverifiedDomainError,
+              "provider for #{provider.domain.inspect} has not proven it owns that domain — " \
+              "refusing to link the existing account #{claims.email.inspect}"
+      end
+
       def jit_create_user(claims)
         # SSO users authenticate at the IdP; the random password satisfies
         # has_secure_password and is unguessable, never used to log in.

data/lib/open_loam/version.rb

@@ -1,3 +1,3 @@
 module OpenLoam
-  VERSION = "0.2.0"
+  VERSION = "0.3.0"
 end

data/lib/open_loam.rb

@@ -7,6 +7,7 @@ require "open_loam/lifecycle"
 require "open_loam/configs"
 require "open_loam/features"
 require "open_loam/auth_throttle"
+require "open_loam/outbound_url"
 require "open_loam/dictionaries"
 require "open_loam/custom_field_index"
 require "open_loam/undo"
@@ -44,6 +45,7 @@ require "open_loam/business_rules"
 require "open_loam/webhooks"
 require "open_loam/inbound_webhooks"
 require "open_loam/durable_events"
+require "open_loam/event_log"
 require "open_loam/engine" if defined?(Rails::Engine)
 
 module OpenLoam

data/lib/tasks/open_loam.rake

@@ -103,6 +103,38 @@ namespace :open_loam do
     end
   end
 
+  namespace :sso do
+    # Domain ownership can only be granted from OUTSIDE the tenant: the manager
+    # who typed the domain is the party this check exists to constrain. Confirm
+    # ownership out of band (DNS TXT, a signed request from the domain's
+    # operator, an existing contract) BEFORE running this.
+    #
+    #   bin/rails open_loam:sso:verify_domain[42]
+    desc "Mark an SSO provider's domain as proven-owned (operator only)"
+    task :verify_domain, %i[provider_id] => :environment do |_task, args|
+      provider = OpenLoam::SsoProvider.unscoped.find(args[:provider_id])
+      tenant = OpenLoam::Tenant.find(provider.tenant_id)
+      OpenLoam.as_tenant(tenant) { provider.verify_domain! }
+      puts "open_loam:sso:verify_domain — #{provider.domain} verified for tenant #{tenant.slug} (provider #{provider.id})."
+    end
+
+    desc "Revoke an SSO provider's domain verification"
+    task :unverify_domain, %i[provider_id] => :environment do |_task, args|
+      provider = OpenLoam::SsoProvider.unscoped.find(args[:provider_id])
+      tenant = OpenLoam::Tenant.find(provider.tenant_id)
+      OpenLoam.as_tenant(tenant) { provider.update!(domain_verified_at: nil) }
+      puts "open_loam:sso:unverify_domain — #{provider.domain} is no longer verified."
+    end
+
+    desc "List SSO providers and their domain-verification state"
+    task providers: :environment do
+      OpenLoam::SsoProvider.unscoped.order(:domain).each do |provider|
+        state = provider.domain_verified? ? "verified #{provider.domain_verified_at.to_fs(:db)}" : "UNVERIFIED"
+        puts format("%-6s %-30s tenant=%-6s %s", provider.id, provider.domain, provider.tenant_id, state)
+      end
+    end
+  end
+
   namespace :encryption do
     # Rotate a tenant's encrypted data under the current key: read each record's
     # encrypted fields (old key) and re-seal them (new key), one record at a

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: open-loam
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Grzegorz Smajdor
@@ -64,6 +64,7 @@ files:
 - README.md
 - app/jobs/open_loam/custom_field_reindex_job.rb
 - app/jobs/open_loam/event_delivery_job.rb
+- app/jobs/open_loam/event_log_prune_job.rb
 - app/jobs/open_loam/event_redelivery_sweep_job.rb
 - app/jobs/open_loam/webhook_delivery_job.rb
 - app/models/open_loam/api_token.rb
@@ -78,6 +79,7 @@ files:
 - app/models/open_loam/dictionary.rb
 - app/models/open_loam/dictionary_entry.rb
 - app/models/open_loam/event_delivery.rb
+- app/models/open_loam/event_record.rb
 - app/models/open_loam/field_definition.rb
 - app/models/open_loam/inbound_webhook_delivery.rb
 - app/models/open_loam/inbound_webhook_source.rb
@@ -210,6 +212,7 @@ files:
 - lib/generators/open_loam/install/templates/migrations/create_open_loam_dictionaries.rb
 - lib/generators/open_loam/install/templates/migrations/create_open_loam_dictionary_entries.rb
 - lib/generators/open_loam/install/templates/migrations/create_open_loam_event_deliveries.rb
+- lib/generators/open_loam/install/templates/migrations/create_open_loam_event_records.rb
 - lib/generators/open_loam/install/templates/migrations/create_open_loam_field_definitions.rb
 - lib/generators/open_loam/install/templates/migrations/create_open_loam_inbound_webhooks.rb
 - lib/generators/open_loam/install/templates/migrations/create_open_loam_memberships.rb
@@ -256,6 +259,7 @@ files:
 - lib/open_loam/enrichers.rb
 - lib/open_loam/errors.rb
 - lib/open_loam/eval.rb
+- lib/open_loam/event_log.rb
 - lib/open_loam/event_stream.rb
 - lib/open_loam/eventful.rb
 - lib/open_loam/events.rb
@@ -270,6 +274,7 @@ files:
 - lib/open_loam/mcp/server.rb
 - lib/open_loam/notifications.rb
 - lib/open_loam/open_api.rb
+- lib/open_loam/outbound_url.rb
 - lib/open_loam/overrides.rb
 - lib/open_loam/pending_actions.rb
 - lib/open_loam/permissions.rb